fix: align tests and deployment templates with core v0.3.0 (#7)

Restore the build and Kubernetes conformance after the core v0.3.0 upgrade:

- Pass the RuntimeContext argument now required by
  network.GenerateNetworkMappings in the create-to-run test.
- Harden the deployment template to satisfy the
  KUBERNETES_OUTPUT_PROFILE_EPHEMERAL_LOCAL_APPLY_V1 and restricted
  conformance profiles: pod/container securityContext, resource bounds,
  liveness/readiness/startup probes, terminationGracePeriodSeconds and
  automountServiceAccountToken, digest-pinned image, and secretKeyRef-based
  secret injection under restricted profiles.
- Pin the workload to numeric UID 1000 (deployment runAsUser + Dockerfile
  adduser). Kubernetes' runAsNonRoot admission check rejects a container
  whose image user is a non-numeric name, so runAsNonRoot alone would leave
  every deployed pod stuck in CreateContainerConfigError.
- Give the read-only container writable scratch: mount a bounded emptyDir
  (sizeLimit 1Gi) at /tmp and set HOME=/tmp so ~/.cache writes land there
  instead of failing against readOnlyRootFilesystem.
- Label the owned Namespace with app.kubernetes.io/managed-by: codefly and
  elide the inline Secret under restricted profiles.
- Assert the rendered deployment pins runAsUser, mounts and bounds /tmp, and
  redirects HOME, so these runtime requirements can't regress silently past
  static conformance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: antoinetoussaint-byte

deployment_test.go

@@ -1,11 +1,31 @@
 package main
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	agenttesting "github.com/codefly-dev/core/agents/testing"
+	"github.com/stretchr/testify/require"
 )
 
 func TestDeploymentTemplates(t *testing.T) {
-	agenttesting.AssertKustomizeTemplates(t, deploymentFS, Parameters{})
+	destination := agenttesting.AssertKustomizeTemplates(t, deploymentFS, Parameters{})
+
+	rendered, err := os.ReadFile(filepath.Join(destination, "base", "deployment.yaml"))
+	require.NoError(t, err)
+	manifest := string(rendered)
+
+	// Kubernetes rejects runAsNonRoot when the image user is non-numeric, so the
+	// workload must pin a numeric UID matching the Dockerfile's appuser (1000).
+	require.Contains(t, manifest, "runAsUser: 1000")
+	// readOnlyRootFilesystem leaves the container without writable storage, so a
+	// scratch mount at /tmp is required for the app to run.
+	require.Contains(t, manifest, "mountPath: /tmp")
+	// The scratch volume is bounded so a runaway writer evicts only this pod
+	// rather than filling node ephemeral storage.
+	require.Contains(t, manifest, "sizeLimit: 1Gi")
+	// $HOME must point at the writable mount so ~/.cache writes don't hit the
+	// read-only root filesystem.
+	require.Contains(t, manifest, "value: /tmp")
 }

main_test.go

@@ -94,7 +94,7 @@ func testCreateToRun(t *testing.T, runtimeContext *basev0.RuntimeContext) {
 
 	require.Equal(t, 1, len(runtime.Endpoints))
 
-	networkMappings, err := networkManager.GenerateNetworkMappings(ctx, env, workspace, runtime.Identity, runtime.Endpoints)
+	networkMappings, err := networkManager.GenerateNetworkMappings(ctx, env, workspace, runtime.Identity, runtime.Endpoints, runtimeContext)
 	require.NoError(t, err)
 	require.Equal(t, 1, len(networkMappings))
 

templates/builder/Dockerfile.tmpl

@@ -17,7 +17,9 @@ FROM {{.Builder}} as runtime
 
 WORKDIR /app
 
-RUN adduser -D appuser
+# UID pinned to match runAsUser in the kustomize Deployment: Kubernetes'
+# runAsNonRoot check rejects a container whose image user is non-numeric.
+RUN adduser -D -u 1000 appuser
 USER appuser
 
 ENV VIRTUAL_ENV=/app/.venv \

templates/deployment/kustomize/base/deployment.yaml.tmpl

@@ -14,11 +14,75 @@ spec:
         app: {{ .Service.Name.DNSCase }}
         sha: {{ .Sha }}
     spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: {{ .Service.Name.DNSCase }}
-          image: image:tag
+          image: {{ .Image.FullName }}
+          ports:
+            - containerPort: 8080
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
+            seccompProfile:
+              type: RuntimeDefault
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          startupProbe:
+            httpGet:
+              path: /version
+              port: 8080
+            failureThreshold: 30
+            periodSeconds: 2
+          readinessProbe:
+            httpGet:
+              path: /version
+              port: 8080
+          livenessProbe:
+            httpGet:
+              path: /version
+              port: 8080
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
           envFrom:
             - configMapRef:
                 name: config-{{ .Service.Name.DNSCase }}
+{{- if not .Restricted }}
             - secretRef:
                 name: secret-{{ .Service.Name.DNSCase }}
+{{- end }}
+          env:
+            # readOnlyRootFilesystem makes $HOME unwritable; point caches at the
+            # writable scratch mount so libraries that use ~/.cache still work.
+            - name: HOME
+              value: /tmp
+{{- if .Restricted }}
+{{- range $environmentVariable, $reference := .SecretReferences }}
+            - name: {{ $environmentVariable }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $reference.Name }}
+                  key: {{ $reference.Key }}
+                  optional: {{ $reference.Optional }}
+{{- end }}
+{{- end }}
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 1Gi

templates/deployment/kustomize/base/namespace.yaml.tmpl

@@ -3,4 +3,5 @@ kind: Namespace
 metadata:
   name: "{{ .Namespace }}"
   labels:
+    app.kubernetes.io/managed-by: codefly
     istio-injection: "enabled"

templates/deployment/kustomize/overlays/environment/kustomization.yaml.tmpl

@@ -1,9 +1,6 @@
 resources:
   - ../../base
   - configmap.yaml
+{{- if not .Restricted }}
   - secret.yaml
-
-images:
-  - name: image:tag
-    newName: {{.Image.Name}}
-    newTag: {{.Image.Tag}}
+{{- end }}

templates/deployment/kustomize/overlays/environment/secret.yaml.tmpl

@@ -1,3 +1,4 @@
+{{- if not .Restricted }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -6,4 +7,5 @@ metadata:
 data:
 {{- range $key, $value := .Deployment.SecretMap }}
   {{ $key }}: "{{ $value }}"
-  {{- end }}
+{{- end }}
+{{- end }}