Skip to content

🧪 Test suites for Vault and Mondoo Integration#1424

Merged
slntopp merged 3 commits intorefactor/vault-auth-operator-sidefrom
mik/v13/test-vault-and-integration
Mar 13, 2026
Merged

🧪 Test suites for Vault and Mondoo Integration#1424
slntopp merged 3 commits intorefactor/vault-auth-operator-sidefrom
mik/v13/test-vault-and-integration

Conversation

@slntopp
Copy link
Copy Markdown
Member

@slntopp slntopp commented Mar 13, 2026

  • regenerate CRDs

Copy link
Copy Markdown

@mondoo-code-review mondoo-code-review bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Vault e2e test has a broken health check and passes the SA token on the command line.

Comment thread tests/e2e/scripts/verify-vault-external.sh Outdated
Comment thread tests/e2e/scripts/deploy-vault.sh Outdated
Comment thread tests/e2e/scripts/deploy-vault.sh
@slntopp slntopp force-pushed the refactor/vault-auth-operator-side branch from b4bb4b9 to e84720d Compare March 13, 2026 13:21
@slntopp slntopp force-pushed the mik/v13/test-vault-and-integration branch from 69a00cd to c4182e8 Compare March 13, 2026 13:24
@mondoo-code-review mondoo-code-review bot dismissed their stale review March 13, 2026 13:25

Superseded by new review

Copy link
Copy Markdown

@mondoo-code-review mondoo-code-review bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Vault-based dynamic credentials for external cluster scanning work correctly but tokens are embedded in kubeconfig Secrets without automatic rotation.

Comment thread controllers/k8s_scan/vault.go
Comment thread controllers/k8s_scan/deployment_handler.go
Comment thread controllers/k8s_scan/deployment_handler.go
Comment thread tests/e2e/scripts/deploy-vault.sh
@slntopp slntopp force-pushed the mik/v13/test-vault-and-integration branch from c4182e8 to 997b05a Compare March 13, 2026 13:44
Copy link
Copy Markdown

@mondoo-code-review mondoo-code-review bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adds Vault-based credential refresh with automatic requeue and e2e test suite for external cluster scanning.

- name: vault
user:
token: %s
token: "%s"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 warning — Quoting the token with "%s" will embed literal double quotes into the YAML value. If the Vault-issued token ever contains a double quote or backslash, the kubeconfig will be malformed YAML. Consider using yaml.Marshal or at minimum escaping special characters within the token string. That said, Vault SA tokens are typically base64-encoded JWTs so this is unlikely to bite in practice.

@slntopp slntopp merged commit 9dc2874 into refactor/vault-auth-operator-side Mar 13, 2026
16 of 17 checks passed
@slntopp slntopp deleted the mik/v13/test-vault-and-integration branch March 13, 2026 13:46
@github-actions github-actions bot locked and limited conversation to collaborators Mar 13, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants