PINF-989 fill k8s security testing gaps - #761
Merged
danielhoherd merged 3 commits intoAug 3, 2026
Merged
Conversation
…ountPropagation non-regression test Neither Service template sets spec.type at all, so both already default to ClusterIP -- just untested. Added an assertion to each existing "enabled" test confirming "type" stays absent from the rendered spec. Also added a chart-wide sweep asserting no volumeMount sets mountPropagation to HostToContainer or Bidirectional, following the same render-everything- and-report-offenders pattern as the existing hardened-securityContext sweep in the same file. Group C of the PINF-986 remaining-work grouping plan (ServiceOnlyAllowClusterIP Airflow-Deployment-tier leg + MountPropagation). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds test coverage to close Kubernetes security policy gaps for the umbrella airflow Helm chart, focusing on Service type defaults and disallowed volumeMount.mountPropagation values.
Changes:
- Assert that the dag-server and git-sync-relay Services do not set
spec.type(so Kubernetes defaults toClusterIP). - Add a chart-wide render sweep asserting no container uses unsafe
mountPropagationvalues (HostToContainer,Bidirectional) on anyvolumeMount.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
tests/chart/test_git_sync_relay_service.py |
Adds assertions that spec.type is absent from the rendered git-sync-relay Service. |
tests/chart/test_dag_server_service.py |
Adds an assertion that spec.type is absent from the rendered dag-server Service. |
tests/chart/test_container_security_context.py |
Adds a full-chart sweep test to detect unsafe volumeMount.mountPropagation settings across all containers. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Copilot flagged that the comment said Restricted PSA "forbids" the unsafe mountPropagation values, then also said it's "not currently a PSA control itself" -- contradictory. Reworded to state plainly that PSA doesn't validate mountPropagation at all; this is a Kyverno/OPA-style customer policy control instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
spec.typeat all, so both already default toClusterIP-- just untested. Added an assertion to each existing "enabled" test confirmingtypestays absent from the rendered spec.volumeMountsetsmountPropagationtoHostToContainerorBidirectional, following the same render-everything-and-report-offenders pattern as the existing hardened-securityContext sweep in the same file.Closes PINF-986's
ServiceOnlyAllowClusterIPAirflow-Deployment-tier leg andMountPropagationchecklist rows for this chart.Related Issues
https://linear.app/astronomer/issue/PINF-986
Testing
No special testing needed. These are all test changes, filling gaps in our test coverage to validate features.
Merging
release-1.18