mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-14 00:23:54 +09:00
Myasnikov DaniilandClaude Fable 5
dd2f89d208
Main added securitygroup.bats (#2922 membership model) and serviceexposure.bats (#3081 ExposureClass/ServiceExposure) after the Chainsaw migration branch was cut. - securitygroup: two Tests — the aggregated-API projection round-trip (backing CNP marker label, empty-value membership endpointSelector, lineage fromApp + membership fromSG peers, 1:1 rule translation, the view hiding storage internals, unmarked-CNP invisibility via an error op, delete propagation) and the controller membership-label stamp/clear lifecycle. Only the attachments annotation stays a jq script (it is a JSON string). Chainsaw auto-cleanup covers every fixture even on mid-test failure — the bats had no teardown hook and leaked its fixtures. - serviceexposure: the externalIPs backend resolve/Ready/assignedIPs path with the no-MetalLB-pool negative as an error op (ordered after resolvedBackend so it cannot false-pass), and the finalizer-removal test collapsed onto the delete op itself, which waits for full disappearance. - selection: kubernetes-application now also maps to the two OIDC render-side suites (they exercise the same app chart — a gap main's bats selection had too); the new dirs enter all_apps discovery automatically. Selector unit tests extended and green (13/13 under cozytest). - README: suites list updated. Assisted-By: Claude <noreply@anthropic.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
28 lines
899 B
YAML
28 lines
899 B
YAML
# A pod carrying the lineage labels of a managed application. The lineage
|
|
# webhook skips it (managed-by is already set), so these labels are exactly
|
|
# what the securitygroup-controller resolves the attachment to. The full
|
|
# restricted-profile securityContext is required by tenant-test PSA.
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: sg-member-pod-e2e
|
|
labels:
|
|
internal.cozystack.io/managed-by-cozystack: "true"
|
|
apps.cozystack.io/application.group: apps.cozystack.io
|
|
apps.cozystack.io/application.kind: Postgres
|
|
apps.cozystack.io/application.name: sg-member-app
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: pause
|
|
image: registry.k8s.io/pause:3.9
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|