363 lines
13 KiB
Python
363 lines
13 KiB
Python
"""Safety and artifact contracts for the Hermes agent image release lane."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import io
|
|
import json
|
|
import urllib.parse
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[2]
|
|
PIPELINE_PATH = REPO_ROOT / "ci/Jenkinsfile.hermes-agent-image"
|
|
RELEASE_SCRIPT = REPO_ROOT / "ci/scripts/hermes_image_release.py"
|
|
TRIGGER_SCRIPT = (
|
|
REPO_ROOT / "services/hermes/scripts/jenkins_image_build_trigger.py"
|
|
)
|
|
|
|
|
|
def _load_release_module():
|
|
spec = importlib.util.spec_from_file_location("hermes_image_release", RELEASE_SCRIPT)
|
|
assert spec is not None and spec.loader is not None
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def _load_trigger_module():
|
|
spec = importlib.util.spec_from_file_location("jenkins_image_build_trigger", TRIGGER_SCRIPT)
|
|
assert spec is not None and spec.loader is not None
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def _pod_spec() -> dict:
|
|
source = PIPELINE_PATH.read_text(encoding="utf-8")
|
|
pod_yaml = source.split('yaml """', 1)[1].split('"""', 1)[0]
|
|
return yaml.safe_load(pod_yaml)["spec"]
|
|
|
|
|
|
def test_builder_pod_is_daemonless_and_kernel_unprivileged() -> None:
|
|
"""The builder must not gain host, daemon, service-token, or Linux privileges."""
|
|
source = PIPELINE_PATH.read_text(encoding="utf-8")
|
|
spec = _pod_spec()
|
|
assert spec["automountServiceAccountToken"] is False
|
|
assert spec["enableServiceLinks"] is False
|
|
assert "hostPath" not in source
|
|
assert "docker.sock" not in source
|
|
assert "tcp://" not in source
|
|
assert "buildkitd" not in source.lower()
|
|
assert "dind" not in source.lower()
|
|
|
|
containers = {item["name"]: item for item in spec["containers"]}
|
|
kaniko = containers["kaniko"]
|
|
assert kaniko["image"] == (
|
|
"gcr.io/kaniko-project/executor@sha256:"
|
|
"c3109d5926a997b100c4343944e06c6b30a6804b2f9abe0994d3de6ef92b028e"
|
|
)
|
|
for container in containers.values():
|
|
security = container["securityContext"]
|
|
assert security["allowPrivilegeEscalation"] is False
|
|
assert security["capabilities"]["drop"] == ["ALL"]
|
|
assert security["seccompProfile"]["type"] == "RuntimeDefault"
|
|
assert security.get("privileged", False) is False
|
|
|
|
|
|
def test_builder_is_restricted_to_healthy_rpi5_capacity() -> None:
|
|
"""Disposable builds must stay off unhealthy and reserved Atlas nodes."""
|
|
spec = _pod_spec()
|
|
assert spec["nodeSelector"]["hardware"] == "rpi5"
|
|
expressions = spec["affinity"]["nodeAffinity"][
|
|
"requiredDuringSchedulingIgnoredDuringExecution"
|
|
]["nodeSelectorTerms"][0]["matchExpressions"]
|
|
host_rule = next(rule for rule in expressions if rule["key"] == "kubernetes.io/hostname")
|
|
assert host_rule["operator"] == "NotIn"
|
|
assert set(host_rule["values"]) >= {
|
|
"titan-04",
|
|
"titan-14",
|
|
"titan-18",
|
|
"titan-19",
|
|
"titan-22",
|
|
"titan-24",
|
|
}
|
|
|
|
|
|
def test_pipeline_requires_reviewed_main_and_runtime_credentials() -> None:
|
|
"""Publishing requires explicit confirmation and a reviewed main commit."""
|
|
source = PIPELINE_PATH.read_text(encoding="utf-8")
|
|
assert 'test "${PUBLISH_IMAGE}" = "true"' in source
|
|
assert 'test "${CONFIRM_PUBLISH}" = "PUBLISH HERMES AGENT"' in source
|
|
assert 'git rev-parse origin/main' in source
|
|
assert "credentialsId: 'harbor-robot'" in source
|
|
assert "set +x" in source
|
|
assert "umask 077" in source
|
|
assert "unset HARBOR_USER HARBOR_PASSWORD auth" in source
|
|
assert "/busybox/rm -f /kaniko/.docker/config.json" in source
|
|
assert "--digest-file=" in source
|
|
assert "--image-name-with-digest-file=" in source
|
|
assert "--destination=" in source
|
|
|
|
|
|
def test_jenkins_job_is_manual_and_reads_pipeline_from_main() -> None:
|
|
"""JCasC must not publish unreviewed branch contents or poll automatically."""
|
|
config = yaml.safe_load(
|
|
(REPO_ROOT / "services/jenkins/configmap-jcasc.yaml").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
)
|
|
jobs = config["data"]["jobs.yaml"]
|
|
block = jobs.split("pipelineJob('hermes-agent-image')", 1)[1].split(
|
|
"pipelineJob(", 1
|
|
)[0]
|
|
assert "branches('*/main')" in block
|
|
assert "scriptPath('ci/Jenkinsfile.hermes-agent-image')" in block
|
|
assert "authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))" in block
|
|
assert "pipelineTriggers" not in block
|
|
assert "scmTrigger" not in block
|
|
|
|
|
|
def test_agent_trigger_is_limited_to_the_image_job(tmp_path: Path) -> None:
|
|
"""Agent Hermes gets one job token, fixed parameters, and no Jenkins admin API."""
|
|
module = _load_trigger_module()
|
|
revision = "a" * 40
|
|
token_path = tmp_path / "token"
|
|
token_path.write_text("private-job-token\n", encoding="utf-8")
|
|
captured = {}
|
|
|
|
class Response(io.BytesIO):
|
|
status = 201
|
|
headers = {"Location": "http://jenkins/queue/item/42/"}
|
|
|
|
def __enter__(self):
|
|
return self
|
|
|
|
def __exit__(self, *_args):
|
|
self.close()
|
|
|
|
def opener(request, timeout):
|
|
captured["request"] = request
|
|
captured["timeout"] = timeout
|
|
return Response(b"")
|
|
|
|
result = module.trigger_build(revision, token_file=token_path, opener=opener)
|
|
request = captured["request"]
|
|
fields = urllib.parse.parse_qs(request.data.decode("utf-8"))
|
|
assert request.full_url == module.JENKINS_BUILD_URL
|
|
assert fields == {
|
|
"CONFIRM_PUBLISH": ["PUBLISH HERMES AGENT"],
|
|
"EXPECTED_SOURCE_REVISION": [revision],
|
|
"PUBLISH_IMAGE": ["true"],
|
|
"job": ["hermes-agent-image"],
|
|
"token": ["private-job-token"],
|
|
}
|
|
assert captured["timeout"] == 20
|
|
assert "private-job-token" not in json.dumps(result)
|
|
assert result["source_revision"] == revision
|
|
|
|
|
|
def test_agent_trigger_rejects_unsafe_revision_and_empty_token(tmp_path: Path) -> None:
|
|
"""No user-controlled job, URL, or abbreviated revision reaches Jenkins."""
|
|
module = _load_trigger_module()
|
|
token_path = tmp_path / "token"
|
|
token_path.write_text("token\n", encoding="utf-8")
|
|
with pytest.raises(ValueError):
|
|
module.trigger_build("main", token_file=token_path)
|
|
token_path.write_text("\n", encoding="utf-8")
|
|
with pytest.raises(RuntimeError, match="empty"):
|
|
module.trigger_build("a" * 40, token_file=token_path)
|
|
|
|
|
|
def test_agent_trigger_accepts_existing_queue_redirect(tmp_path: Path) -> None:
|
|
"""HTTP 303 means the exact release is already queued, not a trigger failure."""
|
|
module = _load_trigger_module()
|
|
token_path = tmp_path / "token"
|
|
token_path.write_text("token\n", encoding="utf-8")
|
|
|
|
class Response(io.BytesIO):
|
|
status = 303
|
|
headers = {"Location": "http://jenkins/queue/item/7/"}
|
|
|
|
def __enter__(self):
|
|
return self
|
|
|
|
def __exit__(self, *_args):
|
|
self.close()
|
|
|
|
result = module.trigger_build(
|
|
"e" * 40, token_file=token_path, opener=lambda *_args, **_kwargs: Response()
|
|
)
|
|
assert result["status"] == 303
|
|
assert result["queue_path"] == "/queue/item/7/"
|
|
|
|
|
|
def test_job_token_is_generated_and_injected_only_at_runtime() -> None:
|
|
"""The fixed-job credential stays in Vault and pod-lifetime memory."""
|
|
plugins = (REPO_ROOT / "services/jenkins/configmap-plugins.yaml").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
vault = (
|
|
REPO_ROOT / "services/vault/scripts/vault_k8s_auth_configure.sh"
|
|
).read_text(encoding="utf-8")
|
|
jenkins = (REPO_ROOT / "services/jenkins/deployment.yaml").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
agent = (REPO_ROOT / "services/hermes/agent-deployment.yaml").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
stage = (
|
|
REPO_ROOT / "services/hermes/scripts/stage_runtime_access.py"
|
|
).read_text(encoding="utf-8")
|
|
assert "build-token-root:365.v717f8685a_09e" in plugins
|
|
assert "sys/tools/random/32 format=hex" in vault
|
|
assert "kv/atlas/hermes/developer-jenkins" in vault
|
|
assert "HERMES_AGENT_IMAGE_BUILD_TOKEN={{ .Data.data.build_token }}" in jenkins
|
|
assert "agent-inject-secret-jenkins-image-build-token" in agent
|
|
assert '"jenkins-image-build-token"' in stage
|
|
|
|
|
|
def test_release_renderer_preserves_manifest_and_emits_safe_artifacts(tmp_path: Path) -> None:
|
|
"""The release artifact is exact, reviewable, and contains no credentials."""
|
|
module = _load_release_module()
|
|
old_digest = "sha256:" + "1" * 64
|
|
new_digest = "sha256:" + "2" * 64
|
|
revision = "a" * 40
|
|
manifest = tmp_path / "kustomization.yaml"
|
|
manifest.write_text(
|
|
"apiVersion: kustomize.config.k8s.io/v1beta1\n"
|
|
"kind: Kustomization\n"
|
|
"images:\n"
|
|
f" - name: {module.DEFAULT_IMAGE}\n"
|
|
f" digest: {old_digest}\n",
|
|
encoding="utf-8",
|
|
)
|
|
output = tmp_path / "out"
|
|
metadata = module.write_release_artifacts(
|
|
digest=f"{new_digest}\n",
|
|
source_revision=revision,
|
|
destination=f"{module.DEFAULT_IMAGE}:git-{revision}",
|
|
kustomization=manifest,
|
|
output_dir=output,
|
|
)
|
|
|
|
assert manifest.read_text(encoding="utf-8").endswith(f"{old_digest}\n")
|
|
assert (output / "hermes-kustomization.yaml").read_text(
|
|
encoding="utf-8"
|
|
).endswith(f"{new_digest}\n")
|
|
patch = (output / "hermes-image-update.patch").read_text(encoding="utf-8")
|
|
assert f"- digest: {old_digest}" in patch
|
|
assert f"+ digest: {new_digest}" in patch
|
|
assert json.loads(
|
|
(output / "hermes-agent-image.json").read_text(encoding="utf-8")
|
|
) == metadata
|
|
assert set(metadata) == {
|
|
"digest",
|
|
"flux_image",
|
|
"image",
|
|
"published_tag",
|
|
"source_revision",
|
|
}
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("digest", "revision", "destination"),
|
|
[
|
|
("latest", "a" * 40, "registry.bstein.dev/bstein/hermes-agent:git-" + "a" * 40),
|
|
("sha256:" + "1" * 64, "short", "registry.bstein.dev/bstein/hermes-agent:git-short"),
|
|
("sha256:" + "1" * 64, "a" * 40, "registry.bstein.dev/bstein/hermes-agent:latest"),
|
|
],
|
|
)
|
|
def test_release_renderer_rejects_unpinned_inputs(
|
|
tmp_path: Path, digest: str, revision: str, destination: str
|
|
) -> None:
|
|
"""Only exact digests and immutable source-derived tags are accepted."""
|
|
module = _load_release_module()
|
|
manifest = tmp_path / "kustomization.yaml"
|
|
manifest.write_text(
|
|
"images:\n"
|
|
f" - name: {module.DEFAULT_IMAGE}\n"
|
|
" digest: sha256:" + "0" * 64 + "\n",
|
|
encoding="utf-8",
|
|
)
|
|
with pytest.raises(ValueError):
|
|
module.write_release_artifacts(
|
|
digest=digest,
|
|
source_revision=revision,
|
|
destination=destination,
|
|
kustomization=manifest,
|
|
output_dir=tmp_path / "out",
|
|
)
|
|
|
|
|
|
def test_release_renderer_fails_closed_on_manifest_drift(tmp_path: Path) -> None:
|
|
"""Missing, duplicate, or already-current image entries require human review."""
|
|
module = _load_release_module()
|
|
digest = "sha256:" + "f" * 64
|
|
missing = "images:\n - name: example.invalid/other\n digest: " + digest + "\n"
|
|
with pytest.raises(ValueError, match="found 0"):
|
|
module.render_kustomization(missing, digest)
|
|
|
|
duplicate = (
|
|
"images:\n"
|
|
f" - name: {module.DEFAULT_IMAGE}\n digest: {digest}\n"
|
|
f" - name: {module.DEFAULT_IMAGE}\n digest: {digest}\n"
|
|
)
|
|
with pytest.raises(ValueError, match="found 2"):
|
|
module.render_kustomization(duplicate, digest)
|
|
|
|
manifest = tmp_path / "kustomization.yaml"
|
|
manifest.write_text(
|
|
f"images:\n - name: {module.DEFAULT_IMAGE}\n digest: {digest}\n",
|
|
encoding="utf-8",
|
|
)
|
|
revision = "b" * 40
|
|
with pytest.raises(ValueError, match="already matches"):
|
|
module.write_release_artifacts(
|
|
digest=digest,
|
|
source_revision=revision,
|
|
destination=f"{module.DEFAULT_IMAGE}:git-{revision}",
|
|
kustomization=manifest,
|
|
output_dir=tmp_path / "out",
|
|
)
|
|
|
|
|
|
def test_release_cli_reads_digest_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
|
|
"""The pipeline CLI uses the Kaniko digest file as its sole digest input."""
|
|
module = _load_release_module()
|
|
digest = "sha256:" + "c" * 64
|
|
revision = "d" * 40
|
|
manifest = tmp_path / "kustomization.yaml"
|
|
manifest.write_text(
|
|
f"images:\n - name: {module.DEFAULT_IMAGE}\n digest: sha256:"
|
|
+ "0" * 64
|
|
+ "\n",
|
|
encoding="utf-8",
|
|
)
|
|
digest_file = tmp_path / "digest"
|
|
digest_file.write_text(digest + "\n", encoding="utf-8")
|
|
output = tmp_path / "out"
|
|
monkeypatch.setattr(
|
|
"sys.argv",
|
|
[
|
|
"hermes_image_release.py",
|
|
"--digest-file",
|
|
str(digest_file),
|
|
"--source-revision",
|
|
revision,
|
|
"--destination",
|
|
f"{module.DEFAULT_IMAGE}:git-{revision}",
|
|
"--kustomization",
|
|
str(manifest),
|
|
"--output-dir",
|
|
str(output),
|
|
],
|
|
)
|
|
assert module.main() == 0
|
|
assert json.loads(
|
|
(output / "hermes-agent-image.json").read_text(encoding="utf-8")
|
|
)["digest"] == digest
|