Skip to content

Commit

Permalink
Added tests to tests/gh-actions to enable baseline and restricted PSS (
Browse files Browse the repository at this point in the history
…kubeflow#2819)

* Patched PSS labels to multi_tenancy

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>

* Added script in gh-actions to patch PSS/static/baseline/pacthes

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>

* Added PSS scripts for both baseline and restricted labels of static namespaces and renamed directories

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>

* Added tests to enable PSS in gh-actions

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>

* Added workflow test for PSS labels

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>

* Fixed indentation

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>

---------

Signed-off-by: biswajit-9776 <biswajitpatt139@gmail.com>
Signed-off-by: hansinikarunarathne <hansini.20@cse.mrt.ac.lk>
  • Loading branch information
biswajit-9776 authored and hansinikarunarathne committed Aug 14, 2024
1 parent 12b1375 commit d925710
Show file tree
Hide file tree
Showing 9 changed files with 60 additions and 6 deletions.
35 changes: 35 additions & 0 deletions .github/workflows/pss_test.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
name: Appy PSS labels to namespaces
on:
pull_request:
paths:
- .github/workflows/*
- tests/gh-actions/kind-cluster.yaml
- apps/profiles/upstream/**
- common/dex/**
- common/cert-manager/**
- common/oidc-client/oauth2-proxy/**
- common/istio*/**
- tests/gh-actions/install_istio_with_ext_auth.sh
- tests/gh-actions/install_multitenancy.sh

jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4

- name: Install KinD
run: ./tests/gh-actions/install_kind.sh

- name: Create KinD Cluster
run: kind create cluster --config tests/gh-actions/kind-cluster.yaml

- name: Install kustomize
run: ./tests/gh-actions/install_kustomize.sh

- name: Install kubectl
run: ./tests/gh-actions/install_kubectl.sh

- name: Applying Pod Security Standards baseline levels for static namespaces
run: ./tests/gh-actions/enable_baseline_PSS.sh
6 changes: 3 additions & 3 deletions contrib/security/PSS/static/baseline/kustomization.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ kind: Component

patches:
- path: patches/kubeflow-labels.yaml
- path: patches/istio-labels.yaml
- path: patches/istio-system-labels.yaml
- path: patches/cert-manager-labels.yaml
- path: patches/dex-labels.yaml
- path: patches/oauth2-proxy-labels.yaml
- path: patches/auth-labels.yaml
- path: patches/oauth2-proxy-labels.yaml
5 changes: 2 additions & 3 deletions contrib/security/PSS/static/restricted/kustomization.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,7 @@ kind: Component

patches:
- path: patches/kubeflow-labels.yaml
- path: patches/istio-labels.yaml
- path: patches/istio-system-labels.yaml
- path: patches/cert-manager-labels.yaml
- path: patches/dex-labels.yaml
- path: patches/auth-labels.yaml
- path: patches/oauth2-proxy-labels.yaml
- path: patches/istio-labels.yaml
10 changes: 10 additions & 0 deletions tests/gh-actions/enable_baseline_PSS.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
#!/bin/bash

NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")

for NAMESPACE in "${NAMESPACES[@]}"; do
if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
echo "Patching the PSS-baseline labels for namespace $NAMESPACE..."
kubectl patch namespace $NAMESPACE --patch-file ./contrib/security/PSS/static/baseline/patches/${NAMESPACE}-labels.yaml
fi
done
10 changes: 10 additions & 0 deletions tests/gh-actions/enable_restricted_PSS.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
#!/bin/bash

NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")

for NAMESPACE in "${NAMESPACES[@]}"; do
if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
echo "Patching the PSS-restricted labels for namespace $NAMESPACE..."
kubectl patch namespace $NAMESPACE --patch-file ./contrib/security/PSS/static/restricted/patches/${NAMESPACE}-labels.yaml
fi
done

0 comments on commit d925710

Please sign in to comment.