bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security(hermes): update oauth boundaries
Some checks failed
Tests / Declarative: Post Actions failed: 2, passed: 176
Details

Browse Source
This commit is contained in:
jenkins 2026-08-09 13:49:40 -03:00
parent bd7c1640ee
commit 301e5dc30a
2 changed files with 34 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
services/hermes/oauth2-proxy.yaml
View File

@ -74,7 +74,7 @@ spec:
automountServiceAccountToken: true automountServiceAccountToken: true
containers: containers:
- name: oauth2-proxy - name: oauth2-proxy
image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0@sha256:dcb6ff8dd21bf3058f6a22c6fa385fa5b897a9cd3914c88a2cc2bb0a85f8065d image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --provider=oidc - --provider=oidc
@ -94,12 +94,16 @@ spec:
- --cookie-path=/ - --cookie-path=/
- --cookie-secure=true - --cookie-secure=true
- --cookie-samesite=lax - --cookie-samesite=lax
- --cookie-csrf-expire=10m
- --cookie-csrf-per-request=true
- --cookie-csrf-per-request-limit=8
- --cookie-refresh=1h - --cookie-refresh=1h
- --cookie-expire=8h - --cookie-expire=8h
- --upstream=http://hermes-agent.hermes.svc.cluster.local:7681 - --upstream=http://hermes-agent.hermes.svc.cluster.local:7681
- --http-address=0.0.0.0:4180 - --http-address=0.0.0.0:4180
- --skip-provider-button=true - --skip-provider-button=true
- --reverse-proxy=true - --reverse-proxy=true
- --trusted-proxy-ip=10.42.0.0/16
ports: ports:
- {name: http, containerPort: 4180} - {name: http, containerPort: 4180}
readinessProbe: readinessProbe:
@ -164,7 +168,7 @@ spec:
automountServiceAccountToken: true automountServiceAccountToken: true
containers: containers:
- name: oauth2-proxy - name: oauth2-proxy
image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0@sha256:dcb6ff8dd21bf3058f6a22c6fa385fa5b897a9cd3914c88a2cc2bb0a85f8065d image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args:
- --provider=oidc - --provider=oidc
@ -184,12 +188,16 @@ spec:
- --cookie-path=/ - --cookie-path=/
- --cookie-secure=true - --cookie-secure=true
- --cookie-samesite=lax - --cookie-samesite=lax
- --cookie-csrf-expire=10m
- --cookie-csrf-per-request=true
- --cookie-csrf-per-request-limit=8
- --cookie-refresh=1h - --cookie-refresh=1h
- --cookie-expire=8h - --cookie-expire=8h
- --upstream=http://hermes-triage.hermes.svc.cluster.local:8787 - --upstream=http://hermes-triage.hermes.svc.cluster.local:8787
- --http-address=0.0.0.0:4180 - --http-address=0.0.0.0:4180
- --skip-provider-button=true - --skip-provider-button=true
- --reverse-proxy=true - --reverse-proxy=true
- --trusted-proxy-ip=10.42.0.0/16
ports: ports:
- {name: http, containerPort: 4180} - {name: http, containerPort: 4180}
readinessProbe: readinessProbe:

24
testing/tests/test_hermes_herdr.py
View File

@ -175,6 +175,30 @@ def test_agent_ttyd_defers_identity_to_owner_only_oauth_boundary():
] ]
def test_hermes_oauth_boundaries_use_current_hardened_proxy():
documents = [
document
for document in yaml.safe_load_all((HERMES / "oauth2-proxy.yaml").read_text())
if document
]
deployments = [
document
for document in documents
if document["kind"] == "Deployment"
and document["metadata"]["name"].startswith("oauth2-proxy-hermes-")
]
assert len(deployments) == 3
for deployment in deployments:
container = deployment["spec"]["template"]["spec"]["containers"][0]
args = container["args"]
assert "v7.15.3@sha256:10a1165743a192e" in container["image"]
assert "--cookie-csrf-expire=10m" in args
assert "--cookie-csrf-per-request=true" in args
assert "--cookie-csrf-per-request-limit=8" in args
assert "--trusted-proxy-ip=10.42.0.0/16" in args
def test_agent_installs_hermes_integration_before_startup(): def test_agent_installs_hermes_integration_before_startup():
deployment = yaml.safe_load((HERMES / "agent-deployment.yaml").read_text()) deployment = yaml.safe_load((HERMES / "agent-deployment.yaml").read_text())
pod = deployment["spec"]["template"]["spec"] pod = deployment["spec"]["template"]["spec"]