Timofei Larkin 72b81a5c4c test(postgres): check every read path for the password ...

The e2e step looked for the plaintext in the account Secret's raw JSON,
where data is base64, so it passed even with the plaintext stored, and
it ran process substitution under the sandbox's dash. It now runs
under bash, decodes the stored value and requires a SCRAM verifier,
and also checks the application, every Helm revision, what the
tenant's super-admins read through tenantsecrets, and that they cannot
read the account Secret.

Both the step and the backup helper passed the minted password to
kubectl exec as an argument, which travels in the request URI the
audit log records at any level; it now goes to psql on stdin. The
helper's tests stub the mint instead of the removed Secret read, and
the platform Job test names a neutral image, since a first-party one
there counts as an unenumerated image ref.

Assisted-by: LLM
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>

2026-10-27 16:31:20 +01:00

..

flux-aio

fix(flux): tune source-watcher concurrency and CPU under load

2026-07-01 07:42:33 +03:00

installer

feat(operator): default system namespace memory via LimitRange (#3494)

2026-10-07 11:19:26 +03:00

platform

test(postgres): check every read path for the password

2026-10-27 16:31:20 +01:00

talos

fix(talos): skip the registry push of the installer when PUSH=0

2026-10-02 11:02:36 +03:00

testing

fix(e2e): keep chainsaw asserts polling through transient API errors

2026-10-11 11:04:12 +03:00