From 7bc39ac100bc5af06dc76e05454c48b0cf57864b Mon Sep 17 00:00:00 2001 From: Eric Meehan Date: Mon, 26 Oct 2026 13:18:46 -0400 Subject: [PATCH] latest --- .vscode/settings.json | 9 +++++++++ README.md | 17 ++++++++++------- tasks/validate.yml | 5 ++--- tests/test.yml | 17 +++++++++++++++-- 4 files changed, 36 insertions(+), 12 deletions(-) create mode 100755 .vscode/settings.json diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100755 index 0000000..7766bb5 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,9 @@ +{ + "python-envs.pythonProjects": [ + { + "path": ".", + "envManager": "ms-python.python:system", + "packageManager": "ms-python.python:pip" + } + ] +} diff --git a/README.md b/README.md index 55b8ab5..697b1fe 100755 --- a/README.md +++ b/README.md @@ -74,12 +74,15 @@ destination. Rebuild the web image to change it. Keep the DNS A/AAAA addresses, and address families your proxy actually uses. The IPv4 proxy listener can still serve a dual-stack pod via nginx loopback; egress IPv6 requires cluster support. -Both image variables require a non-`latest` explicit tag or a complete -`@sha256:` digest (64 lowercase hex characters). Mutable non-latest tags are -accepted, but **digests are recommended** for reproducibility and supply-chain -verification. Use admission signature/provenance policies and scan your builds. -Reusing a mutable tag alone does not trigger a rollout. Image pull credentials -must be pre-created Kubernetes Secrets, referenced by name, never embedded here. +Both image variables require an explicit tag (including `latest`) or a complete +`@sha256:` digest (64 lowercase hex characters). Tags are mutable; **digests are +recommended** for reproducibility and supply-chain verification. For `latest`, +set `luanti_wasm_image_pull_policy: Always` so Kubernetes checks the registry on +each container start; the role default is `IfNotPresent`, which can reuse a +cached image. Reusing a mutable tag alone does not trigger a rollout. Use +admission signature/provenance policies and scan your builds. Image pull +credentials must be pre-created Kubernetes Secrets, referenced by name, never +embedded here. ## Deploy @@ -251,7 +254,7 @@ YAML, and checks: - default-deny port isolation and exact DNS/game/optional HTTPS destinations; - deterministic config checksum and config-triggered rollout changes; - actual EOM playbook variables, TLS ingress, optional cert-manager and annotations; -- rejection of empty/unversioned/latest images, malformed/wildcard CIDRs, bad +- acceptance of `latest` tags and rejection of empty/unversioned images, malformed/wildcard CIDRs, bad names/hostnames, peer shapes, missing TLS, invalid resources/types and timeouts. [tests/run.sh](tests/run.sh) also syntax-checks the deployment playbook and runs diff --git a/tasks/validate.yml b/tasks/validate.yml index 9a6093c..a768e6e 100755 --- a/tasks/validate.yml +++ b/tasks/validate.yml @@ -26,15 +26,14 @@ - luanti_wasm_ingress_annotations is mapping fail_msg: Invalid Luanti identity, integer/boolean settings, image pull policy, or tmp size. -- name: Validate explicit versioned Luanti images +- name: Validate explicit Luanti image references ansible.builtin.assert: that: - item is string - item | length > 0 - item is match('^(?:[a-z0-9]+(?:[.-][a-z0-9]+)*(?::[0-9]+)?/)?[a-z0-9]+(?:[._-][a-z0-9]+)*(?:/[a-z0-9]+(?:[._-][a-z0-9]+)*)*(?::[A-Za-z0-9_][A-Za-z0-9_.-]{0,127})?(?:@sha256:[a-f0-9]{64})?$') - item is search(':[A-Za-z0-9_][A-Za-z0-9_.-]*$') or item is search('@sha256:[a-f0-9]{64}$') - - item is not search('(?i):latest(?:@|$)') - fail_msg: Supply separate web/proxy image references with an explicit non-latest tag or sha256 digest. + fail_msg: Supply separate web/proxy image references with an explicit tag or sha256 digest. loop: "{{ [luanti_wasm_web_image, luanti_wasm_proxy_image] }}" - name: Validate Luanti list settings diff --git a/tests/test.yml b/tests/test.yml index f1bafaa..05a0801 100755 --- a/tests/test.yml +++ b/tests/test.yml @@ -161,6 +161,21 @@ - _initial_checksum != _luanti_wasm_manifests.deployment.spec.template.metadata.annotations['checksum/config'] - "'proxy_read_timeout 7200s;' in _luanti_wasm_manifests.configmap.data['nginx.conf']" + - name: Accept latest tags for both runtime images + ansible.builtin.set_fact: + luanti_wasm_web_image: registry.invalid/fixture/luanti-web:latest + luanti_wasm_proxy_image: registry.invalid/fixture/lwproxy:latest + + - name: Validate latest-tagged runtime images + ansible.builtin.include_role: + name: ansible-role-luanti-wasm + tasks_from: validate.yml + + - name: Restore pinned test image references + ansible.builtin.set_fact: + luanti_wasm_web_image: registry.invalid/fixture/luanti-web:test-1 + luanti_wasm_proxy_image: "registry.invalid/fixture/lwproxy@sha256:{{ 'a' * 64 }}" + - name: Supply fixture eom inputs ansible.builtin.set_fact: eom_luanti_wasm_web_image: registry.invalid/fixture/eom-web:release-1 @@ -226,8 +241,6 @@ - {luanti_wasm_web_image: ""} - {luanti_wasm_proxy_image: ""} - {luanti_wasm_web_image: 'registry.invalid/team/web'} - - {luanti_wasm_proxy_image: 'registry.invalid/team/proxy:latest'} - - {luanti_wasm_web_image: 'registry.invalid/team/web:LaTeSt'} - {luanti_wasm_proxy_image: 'registry.invalid/team/proxy@sha256:abc'} - {luanti_wasm_web_image: 'https://registry.invalid/team/web:1'} - {luanti_wasm_game_cidrs: []}