ec028eb9d9
# What this PR does Runs Telegram long polling to get updates. It's enabled by setting `FEATURE_TELEGRAM_LONG_POLLING_ENABLED=True`. That will disable webhook and run separate deployment for telegram long polling. Telegram long polling is not very HA mode, but it does not need to expose webhook url to internet and simplifies telegram integration. ## Which issue(s) this PR fixes closes #561 ## Checklist - [x] Unit, integration, and e2e (if applicable) tests updated - [x] Documentation added (or `pr:no public docs` PR label added if not required) - [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not required)
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
suite: test security context for deployments
|
|
templates:
|
|
- celery/deployment.yaml
|
|
- engine/deployment.yaml
|
|
- engine/job-migrate.yaml
|
|
- telegram-polling/deployment.yaml
|
|
release:
|
|
name: oncall
|
|
tests:
|
|
- it: podSecurityContext={} -> spec.template.spec.securityContext is empty (default)
|
|
set:
|
|
telegramPolling.enabled: true
|
|
asserts:
|
|
- isNullOrEmpty:
|
|
path: spec.template.spec.securityContext
|
|
- isNullOrEmpty:
|
|
path: spec.template.spec.containers[0].securityContext
|
|
|
|
- it: podSecurityContext.runAsNonRoot=true -> should fill securityContext
|
|
set:
|
|
telegramPolling.enabled: true
|
|
podSecurityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
asserts:
|
|
- isSubset:
|
|
path: spec.template.spec.securityContext
|
|
content:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
|
|
- it: securityContext.runAsNonRoot=true -> should fill securityContext for container
|
|
set:
|
|
telegramPolling.enabled: true
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
asserts:
|
|
- isSubset:
|
|
path: spec.template.spec.containers[0].securityContext
|
|
content:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|