Timofei Larkin 72b81a5c4c test(postgres): check every read path for the password ...

The e2e step looked for the plaintext in the account Secret's raw JSON,
where data is base64, so it passed even with the plaintext stored, and
it ran process substitution under the sandbox's dash. It now runs
under bash, decodes the stored value and requires a SCRAM verifier,
and also checks the application, every Helm revision, what the
tenant's super-admins read through tenantsecrets, and that they cannot
read the account Secret.

Both the step and the backup helper passed the minted password to
kubectl exec as an argument, which travels in the request URI the
audit log records at any level; it now goes to psql on stdin. The
helper's tests stub the mint instead of the removed Secret read, and
the platform Job test names a neutral image, since a first-party one
there counts as an unenumerated image ref.

Assisted-by: LLM
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>

2026-10-27 16:31:20 +01:00

..

chainsaw-test.yaml

test(postgres): check every read path for the password

2026-10-27 16:31:20 +01:00

postgres.yaml

test(backups): log in as an application user after each restore

2026-09-24 18:11:07 +03:00