stacklok / toolhive / 30364479952
70%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 853
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 69.835% (+0.01%) from 69.823%
30364479952

push

github

web-flow 
operator helm: add opt-in image-discovery Deployment for offline installs (#6047)

* operator helm: add opt-in image-discovery Deployment for air-gap scans

Air-gap image-mirroring tooling (e.g. a vendor portal's image-list
generator) discovers images by grepping `image:` keys out of
`helm template` output. toolhiveRunnerImage, vmcpImage, and
registryAPI.image never appear as `image:` keys — the operator only
injects them into child workloads at runtime via env vars
(TOOLHIVE_RUNNER_IMAGE / VMCP_IMAGE / TOOLHIVE_REGISTRY_API_IMAGE), so
a static manifest scan misses them and an air-gapped install can hit
ImagePullBackOff on the first MCPServer / VirtualMCPServer /
MCPRegistry create.

operator.imageDiscovery.enabled (default false) renders a
`replicas: 0` Deployment referencing all three images. Kubernetes
never schedules a pod from a zero-replica Deployment, so the images
are never pulled or run — the Deployment exists purely to put the
refs in front of a static scan.

Generated with [Claude Code](https://claude.com/claude-code)

* operator helm: harden image-discovery Deployment for admission control

Address review feedback: admission control (PSA restricted, Kyverno, OPA
Gatekeeper, a LimitRange) validates the PodTemplateSpec at CREATE time
regardless of replicas: 0, so the image-discovery Deployment needs the
same security context, resources, imagePullPolicy, and imagePullSecrets
handling as the real operator Deployment or a hardened cluster will
reject it outright when the flag is enabled.

- Mirror operator.podSecurityContext / containerSecurityContext onto
  the image-discovery Deployment and its three containers.
- Add operator.imageDiscovery.resources (default {}) and set it on
  each container so an admission policy requiring explicit requests
  doesn't reject it.
- Set imagePullPolicy on each container for consistency with
  deployment.yaml.
- Inherit operator.imagePullSecrets.
- Guard the Deployment name against the 63-char Kubernetes limi... (continued)

81634 of 116896 relevant lines covered (69.83%)

98.54 hits per line

Coverage Regressions

Lines Coverage ∆ File
3
80.56
 -0.7% pkg/transport/proxy/httpsse/http_proxy.go
2
88.67
 -0.23% pkg/transport/proxy/transparent/transparent_proxy.go
2
61.91
 0.26% pkg/workloads/manager.go
Jobs
ID Job ID Ran Files Coverage
1 30364479952.1 853
69.83
 GitHub Action Run
Source Files on build 30364479952