prisma-risk / tsoracle / 26472982281

95%

push

github

test(kube-e2e): add TLS-enabled deploy cell + verify chart secure-by-default render (#514)

Closes #483.

The kube-e2e workflow previously had only the insecure cell, which passed
`tls.allowInsecurePeer=true` to opt out of #452's secure-by-default render
guard without a comment explaining the choice. This adds:

  1. an explanatory comment on the existing insecure cell;
  2. a second cell in the same kind cluster (release `tsoracle-tls` in
     namespace `e2e-tls`) that mints test certs on the runner via a new
     `kube-e2e-driver` `gen-certs` binary (rcgen, fan-SAN leaf covering
     every pod FQDN), creates a `tsoracle-tls-certs` Secret, installs the
     chart with `tls.enabled=true,tls.secretName=...`, and runs the same
     cold-start + soak + sigkill + dynamic-membership assertion lane.

The TLS cell exercises the chart render guard's happy path, the peer
mTLS handshake under realistic kube DNS / Pod-IP rotation, and cross-pod
trust via the cluster-dedicated peer CA model from PR #445.

run-assertions.sh is now parameterised by `RELEASE` and `JOB_DIR` env
vars; defaults preserve the insecure cell's prior behaviour. The driver
gains `--tls-ca`/`--tls-cert`/`--tls-key` flags wired through every soak
mode; clap's `requires` keeps the mTLS pair all-or-nothing. The cert is
minted with `--replicas 4` so the dynamic-membership scale-up to 4 stays
within the SAN list and does not surface as an SNI flake.

31 of 70 new or added lines in 1 file covered. (44.29%)

13445 of 14154 relevant lines covered (94.99%)

406658.76 hits per line