titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

ci(hermes): permit WebUI test package setup

Browse Source
This commit is contained in:
jenkins 2026-08-23 23:10:26 -03:00
parent 817c7cebe0
commit 0dd6138d05
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ci/Jenkinsfile.hermes-webui-image
View File

@ -59,8 +59,9 @@ spec:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
drop: ["ALL"] drop: ["ALL"]
runAsNonRoot: true add: ["CHOWN", "FOWNER", "DAC_OVERRIDE", "SETGID", "SETUID"]
runAsUser: 1000 runAsNonRoot: false
runAsUser: 0
seccompProfile: seccompProfile:
type: RuntimeDefault type: RuntimeDefault
resources: resources:

10
testing/tests/test_hermes_webui_release.py
View File

@ -137,6 +137,16 @@ def test_pipeline_builds_exact_reviewed_anchor_from_main() -> None:
assert spec["enableServiceLinks"] is False assert spec["enableServiceLinks"] is False
containers = {item["name"]: item for item in spec["containers"]} containers = {item["name"]: item for item in spec["containers"]}
assert "kaniko" in containers assert "kaniko" in containers
python_security = containers["python"]["securityContext"]
assert python_security["runAsUser"] == 0
assert python_security["runAsNonRoot"] is False
assert set(python_security["capabilities"]["add"]) == {
"CHOWN",
"FOWNER",
"DAC_OVERRIDE",
"SETGID",
"SETUID",
}
assert containers["kaniko"]["resources"]["requests"]["ephemeral-storage"] == "10Gi" assert containers["kaniko"]["resources"]["requests"]["ephemeral-storage"] == "10Gi"
assert containers["kaniko"]["resources"]["limits"]["ephemeral-storage"] == "20Gi" assert containers["kaniko"]["resources"]["limits"]["ephemeral-storage"] == "20Gi"
assert spec["nodeSelector"] == {"kubernetes.io/arch": "arm64"} assert spec["nodeSelector"] == {"kubernetes.io/arch": "arm64"}