22 lines
1.1 KiB
Python
22 lines
1.1 KiB
Python
|
"""Row E7: the executor's lldap_set_password comes from the LLDAP image the sso server runs (NK-WP-0058-T02).
|
||
|
|
|
||
|
|
The executor image copies /app/lldap_set_password from a digest-pinned LLDAP image (bounded-executor/Containerfile).
|
||
|
|
The tool speaks LLDAP's OPAQUE protocol, so it must be the server's own version: the two digests must be equal.
|
||
|
|
"""
|
||
|
|
import re
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
import yaml
|
||
|
|
|
||
|
|
REPO = Path(__file__).resolve().parents[3]
|
||
|
|
DIGEST = r'docker\.io/lldap/lldap@(sha256:[0-9a-f]{64})'
|
||
|
|
|
||
|
|
|
||
|
|
def test_executor_tool_matches_the_lldap_server():
|
||
|
|
tool = re.findall(DIGEST, (REPO / 'bounded-executor/Containerfile').read_text())
|
||
|
|
deployment = next(d for d in yaml.safe_load_all((REPO / 'sso-mfa/k8s/lldap/deployment.yaml').read_text())
|
||
|
|
if d and d.get('kind') == 'Deployment')
|
||
|
|
server = [m for c in deployment['spec']['template']['spec']['containers'] for m in re.findall(DIGEST, c['image'])]
|
||
|
|
assert len(tool) == 1 and len(server) == 1, (tool, server)
|
||
|
|
assert tool == server, 'the executor image would copy lldap_set_password from another LLDAP version'
|