diff --git a/.vib/harbor-portal/goss/goss.yaml b/.vib/harbor-portal/goss/goss.yaml new file mode 100644 index 000000000000..35a648a403f4 --- /dev/null +++ b/.vib/harbor-portal/goss/goss.yaml @@ -0,0 +1,12 @@ +gossfile: + # Goss tests exclusive to the current container + ../../harbor-portal/goss/harbor-portal.yaml: {} + # Load scripts from .vib/common/goss/templates + ../../common/goss/templates/check-binaries.yaml: {} + ../../common/goss/templates/check-broken-symlinks.yaml: {} + ../../common/goss/templates/check-ca-certs.yaml: {} + ../../common/goss/templates/check-directories.yaml: {} + ../../common/goss/templates/check-files.yaml: {} + ../../common/goss/templates/check-linked-libraries.yaml: {} + ../../common/goss/templates/check-sed-in-place.yaml: {} + ../../common/goss/templates/check-spdx.yaml: {} diff --git a/.vib/harbor-portal/goss/harbor-portal.yaml b/.vib/harbor-portal/goss/harbor-portal.yaml new file mode 100644 index 000000000000..1dfc8cbfaf40 --- /dev/null +++ b/.vib/harbor-portal/goss/harbor-portal.yaml @@ -0,0 +1,28 @@ +group: + harbor: + exists: true +user: + harbor: + exists: true +file: + /opt/bitnami/harbor/nginx-conf: + exists: false + /opt/bitnami/nginx/conf: + exists: true + mode: "0775" + owner: harbor + filetype: directory + /opt/bitnami/nginx/conf/nginx.conf: + exists: true + contains: + - "/opt/bitnami/harbor" + - "/opt/bitnami/nginx/conf/mime.types" +command: + # Ensure permissions for Internal TLS + check-permissions-system-certs: + exec: ls -l /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-bundle.trust.crt /etc/ssl/certs/ca-certificates.crt 2>/dev/null | grep ".*-rw-rw-r--.*harbor" + exit-status: 0 + # Ensure a set of directories exist and the non-root user has write privileges to them + check-directories-exist-with-user: + exec: ls -dl /etc/ssl/certs /etc/pki/tls/certs/ 2>/dev/null | grep "drwxrwxr-x.*harbor" + exit-status: 0 \ No newline at end of file diff --git a/.vib/harbor-portal/goss/vars.yaml b/.vib/harbor-portal/goss/vars.yaml new file mode 100644 index 000000000000..02b785267b73 --- /dev/null +++ b/.vib/harbor-portal/goss/vars.yaml @@ -0,0 +1,16 @@ +binaries: + - nginx + - render-template +directories: + - paths: + - /opt/bitnami/nginx/client_body_temp + - /opt/bitnami/nginx/proxy_temp + - /opt/bitnami/nginx/fastcgi_temp + - /opt/bitnami/nginx/scgi_temp + - /opt/bitnami/nginx/uwsgi_temp + - /opt/bitnami/nginx/conf +files: + - paths: + - /opt/bitnami/harbor/swagger.yaml + - /opt/bitnami/harbor/swagger.json +root_dir: /opt/bitnami diff --git a/.vib/harbor-portal/vib-publish.json b/.vib/harbor-portal/vib-publish.json index 8b6fe8eab4e6..6bdd3e2935fb 100644 --- a/.vib/harbor-portal/vib-publish.json +++ b/.vib/harbor-portal/vib-publish.json @@ -3,7 +3,8 @@ "resources": { "url": "{VIB_ENV_CONTAINER_URL}", "path": "{VIB_ENV_PATH}" - } + }, + "runtime_parameters": "Y29tbWFuZDogWyJ0YWlsIiwgIi1mIiwgIi9kZXYvbnVsbCJd" }, "phases": { "package": { @@ -33,6 +34,21 @@ }, "verify": { "actions": [ + { + "action_id": "goss", + "params": { + "resources": { + "path": "/.vib" + }, + "tests_file": "harbor-portal/goss/goss.yaml", + "vars_file": "harbor-portal/goss/vars.yaml", + "remote": { + "pod": { + "workload": "deploy-harbor-portal" + } + } + } + }, { "action_id": "trivy", "params": { diff --git a/.vib/harbor-portal/vib-verify.json b/.vib/harbor-portal/vib-verify.json index a34e8aee9161..1b44530f1236 100644 --- a/.vib/harbor-portal/vib-verify.json +++ b/.vib/harbor-portal/vib-verify.json @@ -3,7 +3,8 @@ "resources": { "url": "{SHA_ARCHIVE}", "path": "{VIB_ENV_PATH}" - } + }, + "runtime_parameters": "Y29tbWFuZDogWyJ0YWlsIiwgIi1mIiwgIi9kZXYvbnVsbCJd" }, "phases": { "package": { @@ -29,6 +30,21 @@ }, "verify": { "actions": [ + { + "action_id": "goss", + "params": { + "resources": { + "path": "/.vib" + }, + "tests_file": "harbor-portal/goss/goss.yaml", + "vars_file": "harbor-portal/goss/vars.yaml", + "remote": { + "pod": { + "workload": "deploy-harbor-portal" + } + } + } + }, { "action_id": "trivy", "params": {