vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-19 10:33:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

feat(kubernetes): add OpenShift-safe Helm profile

Browse source
This commit is contained in:
courtmanr@gmail.com 2026-07-30 17:36:25 +01:00
parent 32a215203c
commit e13f42667e
14 changed files with 380 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

30
.github/workflows/helm-ci.yml vendored
View file

@ -49,3 +49,33 @@ jobs:
--set server.secretEnv.data.API_TOKENS=dummy-token \
--set persistence.enabled=false \
> /tmp/pulse-agent-rendered.yaml
- name: Render and verify the OpenShift profile
run: |
helm template pulse deploy/helm/pulse \
--namespace pulse \
--set openShift.enabled=true \
--set openShift.kubernetesAgent.enabled=true \
--set agent.secretEnv.create=true \
--set agent.secretEnv.data.PULSE_TOKEN=dummy-token \
--set persistence.enabled=false \
--show-only templates/deployment.yaml \
--show-only templates/agent.yaml \
--show-only templates/agent-serviceaccount.yaml \
--show-only templates/agent-rbac.yaml \
> /tmp/pulse-openshift-rendered.yaml
grep -q -- "--enable-kubernetes" /tmp/pulse-openshift-rendered.yaml
grep -q "PULSE_AGENT_ID" /tmp/pulse-openshift-rendered.yaml
grep -q "kind: ClusterRole" /tmp/pulse-openshift-rendered.yaml
grep -q "kind: ClusterRoleBinding" /tmp/pulse-openshift-rendered.yaml
grep -q "runAsNonRoot: true" /tmp/pulse-openshift-rendered.yaml
if grep -q "/var/run/docker.sock" /tmp/pulse-openshift-rendered.yaml; then
echo "OpenShift profile must not mount the Docker socket" >&2
exit 1
fi
if grep -Eq "runAs(User|Group):|fsGroup:" /tmp/pulse-openshift-rendered.yaml; then
echo "OpenShift profile must let the SCC assign UID/GID/fsGroup" >&2
exit 1
fi