stacklok / toolhive / 30364479952

Build # 30364479952

Build Type

push

github

Committed by web-flow

Commit Message

operator helm: add opt-in image-discovery Deployment for offline installs (#6047)

* operator helm: add opt-in image-discovery Deployment for air-gap scans

Air-gap image-mirroring tooling (e.g. a vendor portal's image-list
generator) discovers images by grepping `image:` keys out of
`helm template` output. toolhiveRunnerImage, vmcpImage, and
registryAPI.image never appear as `image:` keys — the operator only
injects them into child workloads at runtime via env vars
(TOOLHIVE_RUNNER_IMAGE / VMCP_IMAGE / TOOLHIVE_REGISTRY_API_IMAGE), so
a static manifest scan misses them and an air-gapped install can hit
ImagePullBackOff on the first MCPServer / VirtualMCPServer /
MCPRegistry create.

operator.imageDiscovery.enabled (default false) renders a
`replicas: 0` Deployment referencing all three images. Kubernetes
never schedules a pod from a zero-replica Deployment, so the images
are never pulled or run — the Deployment exists purely to put the
refs in front of a static scan.

Generated with [Claude Code](https://claude.com/claude-code)

* operator helm: harden image-discovery Deployment for admission control

Address review feedback: admission control (PSA restricted, Kyverno, OPA
Gatekeeper, a LimitRange) validates the PodTemplateSpec at CREATE time
regardless of replicas: 0, so the image-discovery Deployment needs the
same security context, resources, imagePullPolicy, and imagePullSecrets
handling as the real operator Deployment or a hardened cluster will
reject it outright when the flag is enabled.

- Mirror operator.podSecurityContext / containerSecurityContext onto
  the image-discovery Deployment and its three containers.
- Add operator.imageDiscovery.resources (default {}) and set it on
  each container so an admission policy requiring explicit requests
  doesn't reject it.
- Set imagePullPolicy on each container for consistency with
  deployment.yaml.
- Inherit operator.imagePullSecrets.
- Guard the Deployment name against the 63-char Kubernetes limi... (continued)

Coverage Stats

81634 of 116896 relevant lines covered (69.83%)

98.54 hits per line

Source File

Press 'n' to go to next uncovered line, 'b' for previous

Source Not Available