fix: address remaining production audit findings

.custom-gcl.yml

@@ -8,4 +8,4 @@ plugins:
   # logcheck validates structured logging calls and parameters (e.g., balanced key-value pairs)
   - module: "sigs.k8s.io/logtools"
     import: "sigs.k8s.io/logtools/logcheck/gclplugin"
-    version: latest
+    version: v0.10.1

.github/workflows/publish.yml

@@ -15,21 +15,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Compute image tags
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -38,7 +38,7 @@ jobs:
             type=ref,event=tag
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
         with:
           context: .
           push: true
@@ -55,7 +55,7 @@ jobs:
     needs: image
     steps:
       - name: Clone the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Log in to GHCR
         run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
@@ -86,13 +86,13 @@ jobs:
       pull-requests: write
     steps:
       - name: Clone the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           fetch-depth: 0
 
       - name: Run semantic-release
         id: semantic
-        uses: cycjimmy/semantic-release-action@v4
+        uses: cycjimmy/semantic-release-action@16ca923e6ccbb50770c415a0ccd43709a8c5f7a4
         with:
           # semantic-release 24 bundles conventional-changelog-writer 8.
           # Preset 9 requires writer 9 and fails while generating notes.

.github/workflows/security.yml

@@ -0,0 +1,25 @@
+name: Security
+on:
+  push:
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        with:
+          go-version-file: go.mod
+      - run: (cd cmd && go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 -scan=module)
+      - run: make docker-build IMG=celld-operator:scan
+      - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          image-ref: celld-operator:scan
+          vuln-type: os,library
+          severity: HIGH,CRITICAL
+          exit-code: '1'
+          ignore-unfixed: false

.github/workflows/test-chart.yml

@@ -12,6 +12,8 @@ jobs:
       contents: read
     name: Run on Ubuntu
     runs-on: ubuntu-latest
+    env:
+      IMG: controller:latest
     steps:
       - name: Clone the code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -23,9 +25,9 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Install the latest version of kind
+      - name: Install kind
         run: |
-          curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-$(go env GOARCH)
+          curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.32.0/kind-linux-$(go env GOARCH)
           chmod +x ./kind
           sudo mv ./kind /usr/local/bin/kind
 
@@ -38,59 +40,26 @@ jobs:
       - name: Prepare celld-operator
         run: |
           go mod tidy
-          make docker-build IMG=celld-operator:v0.1.0
-          kind load docker-image celld-operator:v0.1.0
+          make docker-build
+          kind load docker-image $IMG
 
       - name: Install Helm
-        run: |
-          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
-
-      - name: Verify Helm installation
-        run: helm version
+        run: make install-helm
 
       - name: Lint Helm Chart
         run: |
           helm lint ./dist/chart
+          go test ./test/chart
 
-# TODO: Uncomment if cert-manager is enabled
-#      - name: Install cert-manager via Helm
-#        run: |
-#          helm repo add jetstack https://charts.jetstack.io
-#          helm repo update
-#          helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set crds.enabled=true
-#
-#      - name: Wait for cert-manager to be ready
-#        run: |
-#          kubectl wait --namespace cert-manager --for=condition=available --timeout=300s deployment/cert-manager
-#          kubectl wait --namespace cert-manager --for=condition=available --timeout=300s deployment/cert-manager-cainjector
-#          kubectl wait --namespace cert-manager --for=condition=available --timeout=300s deployment/cert-manager-webhook
-
-# TODO: Uncomment if Prometheus is enabled
-#      - name: Install Prometheus Operator CRDs
-#        run: |
-#          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
-#          helm repo update
-#          helm install prometheus-crds prometheus-community/prometheus-operator-crds
-#
-#      - name: Install Prometheus via Helm
-#        run: |
-#          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
-#          helm repo update
-#          helm install prometheus prometheus-community/prometheus --namespace monitoring --create-namespace
-#
-#      - name: Wait for Prometheus to be ready
-#        run: |
-#          kubectl wait --namespace monitoring --for=condition=available --timeout=300s deployment/prometheus-server
-
-      - name: Install Helm chart for project
+      - name: Deploy manager via Helm
         run: |
-          helm install my-release ./dist/chart --create-namespace --namespace celld-operator-system
+          make helm-deploy HELM_EXTRA_ARGS="--set controllerManager.container.imagePullPolicy=Never"
+          test "$(kubectl get deployment celld-operator-controller-manager -n celld-operator-system -o jsonpath='{.spec.template.spec.containers[0].image}')" = "$IMG"
 
       - name: Check Helm release status
         run: |
-          helm status my-release --namespace celld-operator-system
+          make helm-status
 
-# TODO: Uncomment if prometheus.enabled is set to true to confirm that the ServiceMonitor gets created
-#      - name: Check Presence of ServiceMonitor
-#        run: |
-#          kubectl wait --namespace celld-operator-system --for=jsonpath='{.kind}'=ServiceMonitor servicemonitor/celld-operator-controller-manager-metrics-monitor
+      - name: Delete isolated cluster
+        if: always()
+        run: kind delete cluster

.github/workflows/test-e2e.yml

@@ -23,9 +23,9 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Install the latest version of kind
+      - name: Install kind v0.32.0
         run: |
-          curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-$(go env GOARCH)
+          curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.32.0/kind-linux-$(go env GOARCH)
           chmod +x ./kind
           sudo mv ./kind /usr/local/bin/kind
 

.github/workflows/test.yml

@@ -27,3 +27,6 @@ jobs:
         run: |
           go mod tidy
           make test
+          make chart-sync
+          git diff --exit-code -- config/crd config/rbac dist/chart
+          (cd cmd && go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 -scan=module)

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.26 AS builder
+FROM golang:1.26.8@sha256:3c3e25a4da13fd0478eed2df1eb35a0e667094a7124d3993a6a1d30f71c17e79 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 
@@ -23,7 +23,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o ma
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:1c2c046bc09ed40fad370b599a0b1ae7987f55b01e247cf27a7c27cd97e5bbc7
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532

Makefile

@@ -86,9 +86,13 @@ setup-test-e2e: ## Set up a Kind cluster for e2e tests if it does not exist
 	esac
 
 .PHONY: test-e2e
-test-e2e: setup-test-e2e manifests generate fmt vet ## Run the e2e tests. Expected an isolated environment using Kind.
-	KIND=$(KIND) KIND_CLUSTER=$(KIND_CLUSTER) go test -tags=e2e ./test/e2e/ -v -ginkgo.v
-	$(MAKE) cleanup-test-e2e
+test-e2e: manifests generate fmt vet ## Run e2e in a newly created, isolated Kind cluster.
+	@case "$(KIND_CLUSTER)" in celld-operator-test-*|celld-operator-audit-*) ;; *) echo "Use a dedicated celld-operator-test-* cluster name" >&2; exit 1;; esac
+	@if $(KIND) get clusters | grep -Fxq "$(KIND_CLUSTER)"; then echo "Refusing to reuse an existing cluster" >&2; exit 1; fi
+	@set -e; task_kubeconfig=$$(mktemp); \
+	trap 'rm -f "$$task_kubeconfig"; $(KIND) delete cluster --name "$(KIND_CLUSTER)"' EXIT; \
+	$(KIND) create cluster --name "$(KIND_CLUSTER)" --kubeconfig "$$task_kubeconfig"; \
+	KUBECONFIG="$$task_kubeconfig" KIND=$(KIND) KIND_CLUSTER=$(KIND_CLUSTER) go test -tags=e2e ./test/e2e/ -v -ginkgo.v
 
 .PHONY: cleanup-test-e2e
 cleanup-test-e2e: ## Tear down the Kind cluster used for e2e tests
@@ -257,3 +261,58 @@ endef
 define gomodver
 $(shell go list -m -f '{{if .Replace}}{{.Replace.Version}}{{else}}{{.Version}}{{end}}' $(1) 2>/dev/null)
 endef
+
+##@ Helm Deployment
+
+## Helm binary to use for deploying the chart
+HELM ?= helm
+## Namespace to deploy the Helm release
+HELM_NAMESPACE ?= celld-operator-system
+## Name of the Helm release
+HELM_RELEASE ?= celld-operator
+## Path to the Helm chart directory
+HELM_CHART_DIR ?= dist/chart
+## Additional arguments to pass to helm commands
+HELM_EXTRA_ARGS ?=
+
+.PHONY: install-helm
+install-helm: ## Require Helm v3.19.0, installing the pinned release if needed.
+	@set -e; \
+	if [ "$$($(HELM) version --template '{{.Version}}' 2>/dev/null || true)" != "v3.19.0" ]; then \
+		task_installer=$$(mktemp); trap 'rm -f "$$task_installer"' EXIT; \
+		curl -fsSL https://raw.githubusercontent.com/helm/helm/v3.19.0/scripts/get-helm-3 -o "$$task_installer"; \
+		printf '%s  %s\n' '4a01413bf2a767ae744b8bbe4485cd83654d9a0a769c92377afc36328d5a007a' "$$task_installer" | sha256sum -c -; \
+		DESIRED_VERSION=v3.19.0 bash "$$task_installer"; \
+	fi; \
+	test "$$($(HELM) version --template '{{.Version}}')" = "v3.19.0"
+
+.PHONY: helm-deploy
+helm-deploy: install-helm ## Deploy manager to the K8s cluster via Helm. Specify an image with IMG.
+	task_image="$(IMG)"; $(HELM) upgrade --install $(HELM_RELEASE) $(HELM_CHART_DIR) \
+		--namespace $(HELM_NAMESPACE) \
+		--create-namespace \
+		--set controllerManager.container.image.repository="$${task_image%:*}" \
+		--set controllerManager.container.image.tag="$${task_image##*:}" \
+		--wait \
+		--timeout 5m \
+		$(HELM_EXTRA_ARGS)
+
+.PHONY: helm-uninstall
+helm-uninstall: ## Uninstall the Helm release from the K8s cluster.
+	$(HELM) uninstall $(HELM_RELEASE) --namespace $(HELM_NAMESPACE)
+
+.PHONY: helm-status
+helm-status: ## Show Helm release status.
+	$(HELM) status $(HELM_RELEASE) --namespace $(HELM_NAMESPACE)
+
+.PHONY: helm-history
+helm-history: ## Show Helm release history.
+	$(HELM) history $(HELM_RELEASE) --namespace $(HELM_NAMESPACE)
+
+.PHONY: helm-rollback
+helm-rollback: ## Rollback to previous Helm release.
+	$(HELM) rollback $(HELM_RELEASE) --namespace $(HELM_NAMESPACE)
+
+.PHONY: chart-sync
+chart-sync: manifests generate ## Refresh the customized Helm CRD and RBAC from controller-gen.
+	python3 hack/sync-chart.py

PROJECT

@@ -7,7 +7,9 @@ domain: celld-operator.io
 layout:
 - go.kubebuilder.io/v4
 plugins:
-  helm.kubebuilder.io/v1-alpha: {}
+  helm.kubebuilder.io/v2-alpha:
+    manifests: dist/install.yaml
+    output: dist
 projectName: celld-operator
 repo: github.com/ezgamehost/celld-operator
 resources:
@@ -16,8 +18,6 @@ resources:
     namespaced: true
   controller: true
   domain: celld-operator.io
-  group: ""
-  # Empty group: the CRD group is the domain itself (celld-operator.io).
   kind: WorkerApp
   path: github.com/ezgamehost/celld-operator/api/v1alpha1
   version: v1alpha1