open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 10:32:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): prove security administration custody live

Browse Source
This commit is contained in:
whyour
2026-08-25 09:15:40 +08:00
parent 2eb8b29e51
commit c6b9e1504c
14 changed files with 2391 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/back/ql3SecurityAdministrationKubernetesAudit.test.cjs
+20
View File
@@ -48,6 +48,26 @@ test('rejects Kubernetes API token authority in the administration Job', () => {
);
});
test('rejects recursive fsGroup rewrites of persistent credential custody', () => {
const report = auditSecurityAdministrationKubernetes({
root: ROOT,
readFile: intercept(
'deploy/kubernetes/ql3-cluster/operations/security-administration/base/job.yaml',
(value) => value.replace(
'fsGroupChangePolicy: OnRootMismatch',
'fsGroupChangePolicy: Always',
),
),
});
assert.equal(report.compatible, false);
assert.ok(
report.findings.some(
({ code }) => code === 'QL3_SECURITY_ADMIN_KUBERNETES_JOB_BOUNDARY_INVALID',
),
);
});
test('rejects a non-persistent credential delivery boundary', () => {
const report = auditSecurityAdministrationKubernetes({
root: ROOT,