41 lines
5.2 KiB
Python
41 lines
5.2 KiB
Python
import pathlib,subprocess,yaml,json,shlex,copy
|
|
w=pathlib.Path('/tmp/forgejo-private-work'); packet=pathlib.Path('/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/apps-chart-projection-r1')
|
|
helm=pathlib.Path('/home/worsch/.local/bin/helm').resolve(); case=yaml.safe_load((packet/'preimages/helm/forgejo-values.yaml').read_text()); case.update(yaml.safe_load((packet/'preimages/helm/forgejo-registry-values.yaml').read_text()))
|
|
# Source values remain isolated synthetic/public controls, never published release values.
|
|
oauth={'name':'synthetic-netkingdom','provider':'openidConnect','key':'synthetic-public-id','autoDiscoverUrl':'https://synthetic.invalid/.well-known/openid-configuration','secretFile':'/run/forgejo-oidc/CLIENT_SECRET','requiredClaimName':'groups','requiredClaimValues':'forge-admins,forge-coulomb-owners,forge-coulomb-readers','scopes':'openid,profile,email,groups'}
|
|
case['gitea']['oauth']=[oauth]
|
|
case.setdefault('deployment',{})['env']=[x for x in case.get('deployment',{}).get('env',[]) if not x['name'].startswith('GITEA_OAUTH_')]
|
|
for n in ['helm-home','helm-config','helm-cache','helm-data','helm-plugins']:(w/n).mkdir(exist_ok=True)
|
|
base=['bwrap','--unshare-pid','--unshare-net','--ro-bind','/usr','/usr','--ro-bind','/lib','/lib','--ro-bind','/lib64','/lib64','--symlink','usr/bin','/bin','--proc','/proc','--dev','/dev','--tmpfs','/tmp','--bind',str(w),str(w),'--ro-bind',str(helm),'/helm','--chdir',str(w),'--','env','-i','PATH=/usr/bin:/bin','HOME='+str(w/'helm-home'),'HELM_CONFIG_HOME='+str(w/'helm-config'),'HELM_CACHE_HOME='+str(w/'helm-cache'),'HELM_DATA_HOME='+str(w/'helm-data'),'HELM_PLUGINS='+str(w/'helm-plugins'),'/helm','template','forgejo',str(w/'chart/gitea'),'--namespace','forgejo','-f',str(w/'chart-input.yaml')]
|
|
results=[]
|
|
def render(label,values,ok=True):
|
|
(w/'chart-input.yaml').write_text(yaml.safe_dump(values));p=subprocess.run(base,capture_output=True,text=True,timeout=60)
|
|
results.append({'test':label,'returncode':p.returncode});(w/'chart-attempts.json').write_text(json.dumps(results,indent=2))
|
|
assert 'SYNTHETIC-NEVER-RENDER-THIS' not in p.stdout+p.stderr,'refusal leaked conflicting value'
|
|
assert (p.returncode==0)==ok,(label,p.stderr[-3000:])
|
|
return list(yaml.safe_load_all(p.stdout)) if ok else []
|
|
docs=render('actual-private-subpath',case)
|
|
spec=next(d['spec']['template']['spec'] for d in docs if d and d['kind']=='Deployment')
|
|
init=next(x for x in spec['initContainers'] if x['name']=='configure-gitea')
|
|
mount=next(x for x in init['volumeMounts'] if x['name']=='oauth-private-client'); assert mount=={'name':'oauth-private-client','mountPath':'/run/forgejo-oidc/CLIENT_SECRET','subPath':'CLIENT_SECRET','readOnly':True}
|
|
volume=next(x for x in spec['volumes'] if x['name']=='oauth-private-client');assert volume['secret']=={'secretName':'forgejo-netkingdom-oidc-client','defaultMode':288,'items':[{'key':'CLIENT_SECRET','path':'CLIENT_SECRET'}]}
|
|
assert all(not any(m['name']=='oauth-private-client' for m in x.get('volumeMounts',[])) for x in spec['containers'])
|
|
assert not any(e['name'].startswith('GITEA_OAUTH_SECRET_') for e in init['env'])
|
|
script=next(d['stringData']['configure_gitea.sh'] for d in docs if d and d['kind']=='Secret' and 'configure_gitea.sh' in d.get('stringData',{}))
|
|
for operation in ['add-oauth','update-oauth']:
|
|
argv=shlex.split(next(x.strip() for x in script.splitlines() if x.strip().startswith('gitea admin auth '+operation)))
|
|
assert '--secret' not in argv and '${GITEA_OAUTH_SECRET_0}' not in argv
|
|
assert argv[argv.index('--secret-file')+1]=='/run/forgejo-oidc/CLIENT_SECRET'
|
|
assert argv[argv.index('--required-claim-values')+1]==oauth['requiredClaimValues']
|
|
for key in ['secret','existingSecret']:
|
|
bad=copy.deepcopy(case);bad['gitea']['oauth'][0][key]='SYNTHETIC-NEVER-RENDER-THIS';render('conflicting-'+key,bad,False)
|
|
for value in ['', '/wrong/path', '$(SYNTHETIC-NEVER-RENDER-THIS)']:
|
|
bad=copy.deepcopy(case);bad['gitea']['oauth'][0]['secretFile']=value;render('bad-file-path',bad,False)
|
|
bad=copy.deepcopy(case);bad['deployment']['env'].append({'name':'GITEA_OAUTH_SECRET_0','value':'SYNTHETIC-NEVER-RENDER-THIS'});render('indexed-env-conflict',bad,False)
|
|
bad=copy.deepcopy(case);bad['gitea']['oauth'].append(copy.deepcopy(oauth));render('multiple-private-conflict',bad,False)
|
|
bad=copy.deepcopy(case);bad['podSecurityContext']={'fsGroup':2000};render('wrong-fsgroup',bad,False)
|
|
for key,val in [('extraVolumes',{'name':'oauth-private-client','emptyDir':{}}),('extraInitVolumeMounts',{'name':'other','mountPath':'/run/forgejo-oidc'}),('extraContainerVolumeMounts',{'name':'oauth-private-client','mountPath':'/elsewhere'})]:
|
|
bad=copy.deepcopy(case);bad[key]=[val];render(key+'-conflict',bad,False)
|
|
legacy=copy.deepcopy(case);legacy['gitea']['oauth'][0].pop('secretFile');docs=render('legacy-default-secret-unchanged',legacy)
|
|
script=next(d['stringData']['configure_gitea.sh'] for d in docs if d and d['kind']=='Secret' and 'configure_gitea.sh' in d.get('stringData',{}));assert '--secret "${GITEA_OAUTH_SECRET_0}"' in script
|
|
(w/'chart-results.json').write_text(json.dumps({'passed':True,'tests':results,'actual_helm_chart':'12.5.0','network':'disabled by bwrap','namespace_runtime_admission':False},indent=2));print('Helm integrations passed:',len(results))
|