coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare authenticated lifecycle runtime and production release candidate

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 21:40:19 +02:00
parent f3b71b1521
commit 4f546ae3b1
41 changed files with 2598 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

50
tests/test_deployment_candidate.py
View file

@ -97,3 +97,53 @@ def test_optional_workspace_requires_distinct_pins_and_exact_policy_network_peer
data['lifecycle_policy']['package'] = data['policy']['package']
with pytest.raises(ValueError):
module.render(data)
def workload_inputs():
data = inputs()
data['lifecycle_policy'] = {**data['policy'], 'package': 'informed-decision.lifecycle', 'pod_name': 'flex-auth-lifecycle'}
data['lifecycle_delivery'] = True
data['intake_attributes'] = True
data['intake_delivery'] = {'hub_origin': 'http://state-hub.state-hub.svc.cluster.local:8000'}
data['workload_api'] = {'intake': True, 'lifecycle': True,
'registries_configmap': 'informed-decision-workload-registry',
'peers': [{'namespace': 'state-hub', 'app': 'state-hub'}],
'api_egress': [{'ip': '10.43.0.1', 'port': 443}, {'ip': '92.205.62.239', 'port': 6443}]}
return data
def test_private_workload_candidate_has_exact_rbac_peers_and_projection():
objects = module.render(workload_inputs())['items']
services = [o for o in objects if o['kind'] == 'Service']
assert len(services) == 2
assert services[0]['spec']['ports'][0]['port'] == 80
assert services[1]['spec']['ports'][0]['port'] == 8081
assert all(o['kind'] not in ('Secret', 'Ingress') for o in objects)
role = next(o for o in objects if o['kind'] == 'ClusterRole')
assert role['rules'] == [{'apiGroups':['authentication.k8s.io'],'resources':['tokenreviews'],'verbs':['create']}]
binding = next(o for o in objects if o['kind'] == 'ClusterRoleBinding')
assert binding['subjects'] == [{'kind':'ServiceAccount','name':'review','namespace':'informed-decision'}]
policy = next(o for o in objects if o['kind']=='NetworkPolicy' and o['metadata']['name']=='informed-decision-review')
rule = policy['spec']['ingress'][-1]
assert rule['ports'] == [{'protocol':'TCP','port':8081}]
assert rule['from'][0]['namespaceSelector']['matchLabels'] == {'kubernetes.io/metadata.name':'state-hub'}
pod = next(o for o in objects if o['kind']=='Deployment')['spec']['template']['spec']
registry = next(m for m in pod['containers'][0]['volumeMounts'] if m['name']=='workload-registry')
assert registry['readOnly'] and 'subPath' not in registry
requester = next(v for v in pod['volumes'] if v['name']=='sitting-requester')
assert requester['secret']['secretName'] == 'informed-decision-sitting-requester'
assert requester['secret']['defaultMode'] == 0o440
config = json.loads(next(o for o in objects if o['kind']=='ConfigMap')['data']['runtime.json'])
assert config['workload_api']['token_review']['origin'] == 'https://kubernetes.default.svc:443'
@pytest.mark.parametrize('fault', ['wildcard','missing_delivery','no_policy','broad_api','false_type','empty_peers'])
def test_private_workload_candidate_refuses_incomplete_or_broad_configuration(fault):
data = workload_inputs()
if fault == 'wildcard': data['workload_api']['peers'][0]['app']='*'
if fault == 'missing_delivery': del data['intake_delivery']
if fault == 'no_policy': del data['lifecycle_policy']
if fault == 'broad_api': data['workload_api']['api_egress'][0]['ip']='10.0.0.0/8'
if fault == 'false_type': data['workload_api']['intake']='true'
if fault == 'empty_peers': data['workload_api']['peers']=[]
with pytest.raises(ValueError): module.render(data)