From aebaa4f1fae6465f698e919d8a4c239a133aa410 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 14:24:02 +0000 Subject: [PATCH 01/23] Add sample kube linter workflow to play with --- .github/workflows/kube-linter.yml | 46 +++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/kube-linter.yml diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml new file mode 100644 index 00000000..5fd47747 --- /dev/null +++ b/.github/workflows/kube-linter.yml @@ -0,0 +1,46 @@ +name: Check Kubernetes YAMLs with kube-linter + +on: + # Note that both `push` and `pull_request` triggers should be present for GitHub to consistently present kube-linter + # SARIF reports. + push: + branches: [ test-branch-kube-lint ] + pull_request: + +jobs: + scan: + runs-on: fase-self-hosted + steps: + - uses: actions/checkout@v6 + + # This prepares directory where github/codeql-action/upload-sarif@v1 looks up report files by default. + - name: Create ../results directory for SARIF report files + shell: bash + run: mkdir -p ../results + + - name: Scan yaml files with kube-linter + uses: stackrox/kube-linter-action@v1.0.7 + id: kube-linter-action-scan + with: + # Adjust this directory to the location where your kubernetes resources and helm charts are located. + directory: components/ra + # Adjust this to the location of kube-linter config you're using, or remove the setting if you'd like to use + # the default config. + # config: sample/.kube-linter-config.yaml + # The following two settings make kube-linter produce scan analysis in SARIF format which would then be + # made available in GitHub UI via upload-sarif action below. + format: sarif + output-file: ../results/kube-linter.sarif + # The following line prevents aborting the workflow immediately in case your files fail kube-linter checks. + # This allows the following upload-sarif action to still upload the results to your GitHub repo. + continue-on-error: true + + - name: Upload SARIF report files to GitHub + uses: github/codeql-action/upload-sarif@v4 + + # Ensure the workflow eventually fails if files did not pass kube-linter checks. + - name: Verify kube-linter-action succeeded + shell: bash + run: | + echo "If this step fails, kube-linter found issues. Check the output of the scan step above." + [[ "${{ steps.kube-linter-action-scan.outcome }}" == "success" ]] \ No newline at end of file From 7eab959862a690adb26caa8515ecf0ec248b46d5 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 14:28:02 +0000 Subject: [PATCH 02/23] Add image --- .github/workflows/kube-linter.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 5fd47747..0371aa6c 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -10,6 +10,7 @@ on: jobs: scan: runs-on: fase-self-hosted + container: ghcr.io/isisbusapps/fase-gh-runner-container:latest steps: - uses: actions/checkout@v6 From 4d510f40d3fcd9de3070712aeb54edea24c48d7f Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 14:32:38 +0000 Subject: [PATCH 03/23] Add permissions --- .github/workflows/kube-linter.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 0371aa6c..899edb7d 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -5,7 +5,10 @@ on: # SARIF reports. push: branches: [ test-branch-kube-lint ] - pull_request: + +permissions: + contents: read + packages: read jobs: scan: From 26726cc290b6d5caf367cf5d478358db392add61 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 14:44:02 +0000 Subject: [PATCH 04/23] testing with dind then will switch back --- .github/workflows/kube-linter.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 899edb7d..2fc54d58 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -12,8 +12,7 @@ permissions: jobs: scan: - runs-on: fase-self-hosted - container: ghcr.io/isisbusapps/fase-gh-runner-container:latest + runs-on: fase-self-hosted-dind steps: - uses: actions/checkout@v6 From d797aaabb65698438c5cbd97ca996f390d71c132 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 16:48:35 +0000 Subject: [PATCH 05/23] Log results --- .github/workflows/kube-linter.yml | 47 ++++++++++++------------------- 1 file changed, 18 insertions(+), 29 deletions(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 2fc54d58..eed8db8e 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -12,38 +12,27 @@ permissions: jobs: scan: - runs-on: fase-self-hosted-dind + runs-on: fase-self-hosted + container: ghcr.io/isisbusapps/fase-gh-runner-container:latest steps: - - uses: actions/checkout@v6 + - name: Checkout code + uses: actions/checkout@v4 - # This prepares directory where github/codeql-action/upload-sarif@v1 looks up report files by default. - - name: Create ../results directory for SARIF report files - shell: bash - run: mkdir -p ../results - - - name: Scan yaml files with kube-linter - uses: stackrox/kube-linter-action@v1.0.7 - id: kube-linter-action-scan + - name: Scan with KubeLinter Action + uses: stackrox/kube-linter-action@v1 + id: kube_linter_scan + continue-on-error: true # Allows us to scrub and log findings before failing the workflow with: - # Adjust this directory to the location where your kubernetes resources and helm charts are located. - directory: components/ra - # Adjust this to the location of kube-linter config you're using, or remove the setting if you'd like to use - # the default config. - # config: sample/.kube-linter-config.yaml - # The following two settings make kube-linter produce scan analysis in SARIF format which would then be - # made available in GitHub UI via upload-sarif action below. - format: sarif - output-file: ../results/kube-linter.sarif - # The following line prevents aborting the workflow immediately in case your files fail kube-linter checks. - # This allows the following upload-sarif action to still upload the results to your GitHub repo. - continue-on-error: true + directory: . + format: plain + output-file: kube-linter.log - - name: Upload SARIF report files to GitHub - uses: github/codeql-action/upload-sarif@v4 + - name: Redact and Stream to Console Log + run: | + cat kube-linter.log - # Ensure the workflow eventually fails if files did not pass kube-linter checks. - - name: Verify kube-linter-action succeeded - shell: bash + - name: Enforce Linter Status run: | - echo "If this step fails, kube-linter found issues. Check the output of the scan step above." - [[ "${{ steps.kube-linter-action-scan.outcome }}" == "success" ]] \ No newline at end of file + if [ "${{ steps.kube_linter_scan.outcome }}" != "success" ]; then + exit 1 + fi \ No newline at end of file From 6d7d5a09d84aefd6ff23a18f3243cb94efeef1d5 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 16:49:23 +0000 Subject: [PATCH 06/23] Use 1 directory not whole thing --- .github/workflows/kube-linter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index eed8db8e..76610bb4 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -23,7 +23,7 @@ jobs: id: kube_linter_scan continue-on-error: true # Allows us to scrub and log findings before failing the workflow with: - directory: . + directory: /components/ra/user-claims-backend format: plain output-file: kube-linter.log From c4c3e424468f568d5f78128fb471cf494038288d Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 16:51:31 +0000 Subject: [PATCH 07/23] Test dind --- .github/workflows/kube-linter.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 76610bb4..d8015024 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -12,8 +12,7 @@ permissions: jobs: scan: - runs-on: fase-self-hosted - container: ghcr.io/isisbusapps/fase-gh-runner-container:latest + runs-on: fase-self-hosted-dind steps: - name: Checkout code uses: actions/checkout@v4 From e81e7f1e661fdccce33e0349973c84bd27adbdae Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 16:56:54 +0000 Subject: [PATCH 08/23] Fix repo pull --- .github/workflows/kube-linter.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index d8015024..00ae6f42 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -15,14 +15,17 @@ jobs: runs-on: fase-self-hosted-dind steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v6 + with: + repository: isisbusapps/gitops + token: ${{ secrets.workflow-token }} - name: Scan with KubeLinter Action uses: stackrox/kube-linter-action@v1 id: kube_linter_scan continue-on-error: true # Allows us to scrub and log findings before failing the workflow with: - directory: /components/ra/user-claims-backend + directory: components/ra/user-claims-backend format: plain output-file: kube-linter.log From f98a8a8813bb38d5ac522a1e09b9421759a90f26 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 16:57:41 +0000 Subject: [PATCH 09/23] Test without token --- .github/workflows/kube-linter.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 00ae6f42..43cfdb0b 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -16,9 +16,6 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v6 - with: - repository: isisbusapps/gitops - token: ${{ secrets.workflow-token }} - name: Scan with KubeLinter Action uses: stackrox/kube-linter-action@v1 From 2e838837926fc2f507412f063f6d4a99424743cf Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Wed, 4 Nov 2026 16:59:09 +0000 Subject: [PATCH 10/23] Remove as not neede --- .github/workflows/kube-linter.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 43cfdb0b..1e3b2d88 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -26,10 +26,6 @@ jobs: format: plain output-file: kube-linter.log - - name: Redact and Stream to Console Log - run: | - cat kube-linter.log - - name: Enforce Linter Status run: | if [ "${{ steps.kube_linter_scan.outcome }}" != "success" ]; then From 5a6210aa9395cac0e5988da035eb85b5087a329d Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 11:15:00 +0000 Subject: [PATCH 11/23] Test out matrix strategy for folder checking with the action --- .github/workflows/kube-linter.yml | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 1e3b2d88..36fe064b 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -1,33 +1,29 @@ name: Check Kubernetes YAMLs with kube-linter on: - # Note that both `push` and `pull_request` triggers should be present for GitHub to consistently present kube-linter - # SARIF reports. push: branches: [ test-branch-kube-lint ] + # Keep this list in sync with the matrix below + paths: + - 'components/ra/user-claims-backend/**' permissions: contents: read - packages: read jobs: scan: runs-on: fase-self-hosted-dind + strategy: + fail-fast: true + matrix: + directory: + - components/ra/user-claims-backend steps: - name: Checkout code uses: actions/checkout@v6 - - name: Scan with KubeLinter Action + - name: Scan ${{ matrix.directory }} with KubeLinter uses: stackrox/kube-linter-action@v1 - id: kube_linter_scan - continue-on-error: true # Allows us to scrub and log findings before failing the workflow with: - directory: components/ra/user-claims-backend + directory: ${{ matrix.directory }} format: plain - output-file: kube-linter.log - - - name: Enforce Linter Status - run: | - if [ "${{ steps.kube_linter_scan.outcome }}" != "success" ]; then - exit 1 - fi \ No newline at end of file From 1b00bd08de1cdff6f2c5147b5caab17d6346c28a Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 11:16:20 +0000 Subject: [PATCH 12/23] Fake change will revert --- components/ra/user-claims-backend/base/deployment.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/components/ra/user-claims-backend/base/deployment.yaml b/components/ra/user-claims-backend/base/deployment.yaml index a708afdf..01a4c6a3 100644 --- a/components/ra/user-claims-backend/base/deployment.yaml +++ b/components/ra/user-claims-backend/base/deployment.yaml @@ -42,3 +42,5 @@ spec: volumes: - name: uploads emptyDir: {} + + From 98da7a112c0ae943616f54fe278d8b8ca4b563ae Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 12:43:04 +0000 Subject: [PATCH 13/23] Use config file --- .github/workflows/kube-linter.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 36fe064b..5e90ef67 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -26,4 +26,5 @@ jobs: uses: stackrox/kube-linter-action@v1 with: directory: ${{ matrix.directory }} + config: .kube-linter.yaml format: plain From b85f333d0f5b3902ad4feb6cc3e311ebc9e18588 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 12:43:31 +0000 Subject: [PATCH 14/23] Add mentioned config file as it wont work without --- .kube-linter.yaml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .kube-linter.yaml diff --git a/.kube-linter.yaml b/.kube-linter.yaml new file mode 100644 index 00000000..5a4a7aff --- /dev/null +++ b/.kube-linter.yaml @@ -0,0 +1,7 @@ +# kube-linter configuration +# Uses kube-linter's default checks, minus the CPU/memory requests and limits checks. +checks: + addAllBuiltIn: false # Keep the default set rather than enabling every built-in check + exclude: + - unset-cpu-requirements + - unset-memory-requirements From e64a2995f4983038fd7dcd5123858b74bcd75580 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 12:45:37 +0000 Subject: [PATCH 15/23] register change to test --- components/ra/user-claims-backend/base/deployment.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/components/ra/user-claims-backend/base/deployment.yaml b/components/ra/user-claims-backend/base/deployment.yaml index 01a4c6a3..a708afdf 100644 --- a/components/ra/user-claims-backend/base/deployment.yaml +++ b/components/ra/user-claims-backend/base/deployment.yaml @@ -42,5 +42,3 @@ spec: volumes: - name: uploads emptyDir: {} - - From 08cf5fcedf50b061cad4596f027997c5effd3a3a Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 14:33:50 +0000 Subject: [PATCH 16/23] Fix changes on this file --- components/ra/user-claims-backend/base/deployment.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/components/ra/user-claims-backend/base/deployment.yaml b/components/ra/user-claims-backend/base/deployment.yaml index a708afdf..ed1b69f4 100644 --- a/components/ra/user-claims-backend/base/deployment.yaml +++ b/components/ra/user-claims-backend/base/deployment.yaml @@ -22,6 +22,11 @@ spec: containers: - name: user-claims-backend imagePullPolicy: Always + securityContext: + runAsNonRoot: true + runAsUser: 1000 + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false ports: - containerPort: 3001 envFrom: From acc53f0b821ce24bdfeb0b32d3050c24b5c8cb5a Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 14:39:33 +0000 Subject: [PATCH 17/23] Only add overlays --- .github/workflows/kube-linter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 5e90ef67..9888dc37 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -17,7 +17,7 @@ jobs: fail-fast: true matrix: directory: - - components/ra/user-claims-backend + - components/ra/user-claims-backend/overlays steps: - name: Checkout code uses: actions/checkout@v6 From 7c3bbd0201cc9e1830b77cece867282802dc43a4 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 14:40:39 +0000 Subject: [PATCH 18/23] Add empty space to trigger job --- components/ra/user-claims-backend/base/deployment.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/components/ra/user-claims-backend/base/deployment.yaml b/components/ra/user-claims-backend/base/deployment.yaml index ed1b69f4..5e51ac11 100644 --- a/components/ra/user-claims-backend/base/deployment.yaml +++ b/components/ra/user-claims-backend/base/deployment.yaml @@ -47,3 +47,4 @@ spec: volumes: - name: uploads emptyDir: {} + From cba7c8acef39d418060264d30834da6780fe3189 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 14:43:35 +0000 Subject: [PATCH 19/23] Add fixes to frontend --- components/ra/user-claims-frontend/base/deployment.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/components/ra/user-claims-frontend/base/deployment.yaml b/components/ra/user-claims-frontend/base/deployment.yaml index 7827f4f3..fb9819ec 100644 --- a/components/ra/user-claims-frontend/base/deployment.yaml +++ b/components/ra/user-claims-frontend/base/deployment.yaml @@ -21,6 +21,11 @@ spec: spec: containers: - name: user-claims-frontend + securityContext: + runAsNonRoot: true + runAsUser: 1000 + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false imagePullPolicy: Always ports: - containerPort: 6011 From f1934b75a5e2c203f26b40709523d46c0daaff42 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 14:44:13 +0000 Subject: [PATCH 20/23] Add to workflow --- .github/workflows/kube-linter.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 9888dc37..6a63f2ed 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -6,6 +6,7 @@ on: # Keep this list in sync with the matrix below paths: - 'components/ra/user-claims-backend/**' + - 'components/ra/user-claims-frontend/**' permissions: contents: read @@ -18,6 +19,7 @@ jobs: matrix: directory: - components/ra/user-claims-backend/overlays + - components/ra/user-claims-frontend/overlays steps: - name: Checkout code uses: actions/checkout@v6 From bffdd28e6b67f3a77126c8844e3d50fc0a24f26c Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 14:46:50 +0000 Subject: [PATCH 21/23] Set it to R&A files --- .github/workflows/kube-linter.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/kube-linter.yml b/.github/workflows/kube-linter.yml index 6a63f2ed..5bbe3566 100644 --- a/.github/workflows/kube-linter.yml +++ b/.github/workflows/kube-linter.yml @@ -5,8 +5,7 @@ on: branches: [ test-branch-kube-lint ] # Keep this list in sync with the matrix below paths: - - 'components/ra/user-claims-backend/**' - - 'components/ra/user-claims-frontend/**' + - 'components/ra/**' permissions: contents: read From 478844227ce9dbd2f9869110fe8b1756f6769351 Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 14:57:35 +0000 Subject: [PATCH 22/23] Add a space --- components/ra/user-claims-frontend/base/deployment.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/components/ra/user-claims-frontend/base/deployment.yaml b/components/ra/user-claims-frontend/base/deployment.yaml index fb9819ec..43d5b5cd 100644 --- a/components/ra/user-claims-frontend/base/deployment.yaml +++ b/components/ra/user-claims-frontend/base/deployment.yaml @@ -35,3 +35,4 @@ spec: - name: env-config secret: secretName: user-claims-frontend + From df3652718ba1db046755b1dc114aa4ddc8aca84a Mon Sep 17 00:00:00 2001 From: William-Edwards-STFC Date: Thu, 5 Nov 2026 16:04:49 +0000 Subject: [PATCH 23/23] Fix volume host path --- components/ra/user-claims-backend/base/deployment.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/components/ra/user-claims-backend/base/deployment.yaml b/components/ra/user-claims-backend/base/deployment.yaml index 5e51ac11..5f5c02d1 100644 --- a/components/ra/user-claims-backend/base/deployment.yaml +++ b/components/ra/user-claims-backend/base/deployment.yaml @@ -34,7 +34,7 @@ spec: name: user-claims-backend volumeMounts: - name: uploads - mountPath: "/app/uploads" + mountPath: "/app/backend/uploads" readOnly: false readinessProbe: httpGet: @@ -47,4 +47,3 @@ spec: volumes: - name: uploads emptyDir: {} -