From 95dc5911981adf1ad37aca6c949f33c90708d2a2 Mon Sep 17 00:00:00 2001 From: ZverGuy Date: Wed, 4 Nov 2026 04:12:02 +0700 Subject: [PATCH] test(kubernetes): keep application identity out of guest log streams Guest pods are tenant-controlled, so their lineage labels are not a trustworthy application identity, and the platform must not promote them to the stream fields the parent scopes application logs by. The guest release replaces the monitoring-agents filters and outputs wholesale, which is what keeps the parent's label lift out of guests; pin that so a later change to the guest overrides cannot bring it in. This only covers what the platform ships. A guest admin can still edit the guest's fluent-bit or write to the parent's vlinsert directly; that needs a write-path control, which the logs proposal leaves open. Assisted-by: LLM Signed-off-by: ZverGuy --- ...ring_agents_application_identity_test.yaml | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 packages/apps/kubernetes/tests/monitoring_agents_application_identity_test.yaml diff --git a/packages/apps/kubernetes/tests/monitoring_agents_application_identity_test.yaml b/packages/apps/kubernetes/tests/monitoring_agents_application_identity_test.yaml new file mode 100644 index 000000000..9fbc1c45b --- /dev/null +++ b/packages/apps/kubernetes/tests/monitoring_agents_application_identity_test.yaml @@ -0,0 +1,38 @@ +suite: guest fluent-bit never ships application identity stream fields + +templates: + - templates/helmreleases/monitoring-agents.yaml + +values: + - values/common.yaml + +release: + name: kubernetes-test + namespace: tenant-test + +# Pods in a guest cluster are tenant-controlled, so their +# apps.cozystack.io/application.* labels are not a trustworthy application +# identity, and the platform must not promote them to the stream fields the +# parent scopes application logs by. The guest release replaces the +# monitoring-agents filters and outputs, so it is the guest overrides that keep +# the parent's label lift out. This does not stop a guest admin who edits the +# guest's own fluent-bit or writes to the parent's vlinsert directly; that is +# the write-path control the logs proposal leaves open. + +tests: + - it: does not lift pod labels or declare lineage stream fields in the guest + set: + addons.monitoringAgents.enabled: true + _namespace.monitoring: tenant-test + asserts: + - isKind: + of: HelmRelease + - notMatchRegex: + path: spec.values.fluent-bit.config.filters + pattern: 'kubernetes_labels|apps_cozystack_io_application_' + - notMatchRegex: + path: spec.values.fluent-bit.config.outputs + pattern: 'apps_cozystack_io_application_' + - matchRegex: + path: spec.values.fluent-bit.config.outputs + pattern: '_stream_fields=stream,kubernetes_pod_name,kubernetes_container_name,kubernetes_namespace_name&'