Skip to content

Commit 65b73f0

Browse files
kanywstkanywst
committed
chore: review fixes + lint CI + dependabot
- Pin Istio install to tag 1.30.0 (was unpinned, broke CI reproducibility) - Drop the made-up "About X minutes" estimates from every pattern README - Tone down the unsourced claims in 06 (host-firewall) and 08 (LocalStack) - Restore a one-line recommended reading path in the top README - Add GitHub Actions: shellcheck, yamllint, markdownlint, kubectl dry-run - Add Dependabot for github-actions, docker, terraform
1 parent c93b686 commit 65b73f0

17 files changed

Lines changed: 130 additions & 20 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
open-pull-requests-limit: 5
8+
9+
- package-ecosystem: docker
10+
directory: /08-localstack-aws-sg
11+
schedule:
12+
interval: weekly
13+
open-pull-requests-limit: 3
14+
15+
- package-ecosystem: terraform
16+
directory: /08-localstack-aws-sg/terraform
17+
schedule:
18+
interval: weekly
19+
open-pull-requests-limit: 3

‎.github/workflows/lint.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: lint
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
shellcheck:
14+
runs-on: ubuntu-24.04
15+
steps:
16+
- uses: actions/checkout@v5
17+
- name: ShellCheck all run.sh / cleanup.sh
18+
run: |
19+
set -e
20+
# SC2015: `[ cond ] && ok ... || ng ...` is intentional in assert lines
21+
# because both helpers are simple printf wrappers and ng exits anyway.
22+
fail=0
23+
while IFS= read -r f; do
24+
echo "::group::shellcheck $f"
25+
if ! shellcheck --exclude=SC2015 "$f"; then fail=1; fi
26+
echo "::endgroup::"
27+
done < <(find . -type f \( -name 'run.sh' -o -name 'cleanup.sh' -o -path './lib/*.sh' \))
28+
exit "$fail"
29+
30+
yamllint:
31+
runs-on: ubuntu-24.04
32+
steps:
33+
- uses: actions/checkout@v5
34+
- uses: ibiqlik/action-yamllint@v3
35+
with:
36+
config_file: .yamllint.yml
37+
38+
markdownlint:
39+
runs-on: ubuntu-24.04
40+
steps:
41+
- uses: actions/checkout@v5
42+
- uses: DavidAnson/markdownlint-cli2-action@v20
43+
with:
44+
globs: |
45+
**/*.md
46+
config: .markdownlint.jsonc
47+
48+
kubectl-dry-run:
49+
runs-on: ubuntu-24.04
50+
steps:
51+
- uses: actions/checkout@v5
52+
- name: Install kubectl
53+
uses: azure/setup-kubectl@v4
54+
- name: kubectl --dry-run=client on every manifest
55+
run: |
56+
set -e
57+
fail=0
58+
# Skip CRDs that the client doesn't know about (Calico/Cilium/Istio/SPIRE/Gatekeeper).
59+
# We validate plain k8s manifests only.
60+
while IFS= read -r f; do
61+
case "$f" in
62+
*/policy-db-l4.yaml|*/policy-cart-l7.yaml|*/policy-deny-staging-to-prod.yaml|\
63+
*/policy-allow-audit-exception.yaml|*/peer-auth-strict.yaml|\
64+
*/authz-httpbin-cart-only.yaml|*/template-required-labels.yaml|\
65+
*/constraint-required-labels.yaml|*/template-no-pod-without-netpol.yaml|\
66+
*/constraint-no-pod-without-netpol.yaml|*/sync-config.yaml)
67+
echo "skip CRD-bound: $f"; continue;;
68+
esac
69+
echo "::group::kubectl dry-run $f"
70+
if ! kubectl apply --dry-run=client -f "$f"; then fail=1; fi
71+
echo "::endgroup::"
72+
done < <(find . -type f -path '*/manifests/*.yaml')
73+
exit "$fail"

‎.markdownlint.jsonc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"default": true,
3+
"MD013": false,
4+
"MD024": false,
5+
"MD033": { "allowed_elements": ["picture", "source", "img"] },
6+
"MD036": false,
7+
"MD041": false
8+
}

‎.yamllint.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
extends: default
2+
3+
rules:
4+
line-length: disable
5+
document-start: disable
6+
truthy:
7+
check-keys: false # GitHub Actions uses `on:` which yamllint flags
8+
comments:
9+
min-spaces-from-content: 1
10+
braces:
11+
max-spaces-inside: 1
12+
indentation:
13+
spaces: 2
14+
indent-sequences: consistent
15+
check-multi-line-strings: false
16+
17+
ignore: |
18+
**/.terraform/
19+
**/expected/

‎01-k8s-networkpolicy/README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,6 @@ NetworkPolicy is **additive allow-list**: once any rule selects a pod for `Ingre
2424
./run.sh
2525
```
2626

27-
About 2 minutes the first time (image pulls). The script reuses an existing cluster if you've run it before.
28-
2927
Expected output: [`expected/output.txt`](./expected/output.txt).
3028

3129
## Cleanup

‎02-cilium-l7-identity/README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ Cilium does not write IP addresses into iptables. It assigns a stable numeric **
2020
./run.sh
2121
```
2222

23-
About 3 minutes the first time. The script enables Hubble UI but does not pop the browser; if you want to look, run `cilium hubble ui` afterwards.
24-
2523
Expected output: [`expected/output.txt`](./expected/output.txt).
2624

2725
## Cleanup

‎03-calico-tiered/README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,6 @@ Vanilla `NetworkPolicy` is additive-allow and namespace-scoped. There's no `Deny
2828
./run.sh
2929
```
3030

31-
About 2 minutes. Expected output: [`expected/output.txt`](./expected/output.txt).
32-
3331
## Cleanup
3432

3533
```bash

‎04-istio-mtls-authz/README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,6 @@ NetworkPolicy trusts the network. If a malicious pod takes the same label, it ge
2626
./run.sh
2727
```
2828

29-
About 4 minutes (Istio install dominates). Expected output: [`expected/output.txt`](./expected/output.txt).
30-
3129
## Cleanup
3230

3331
```bash

‎04-istio-mtls-authz/run.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ set -euo pipefail
55
cd "$(dirname "$0")"
66

77
CLUSTER=ms-04-istio
8+
ISTIO_TAG="${ISTIO_TAG:-1.30.0}"
89

910
say() { printf '\n\033[1;36m==> %s\033[0m\n' "$*"; }
1011
ok() { printf ' \033[32mPASS\033[0m %s\n' "$*"; }
@@ -18,9 +19,9 @@ else
1819
fi
1920
kubectl config use-context "kind-$CLUSTER" >/dev/null
2021

21-
say "2/7 Istio install (default profile, minimal)"
22+
say "2/7 Istio install (minimal profile, tag $ISTIO_TAG)"
2223
if ! kubectl get ns istio-system >/dev/null 2>&1; then
23-
istioctl install --set profile=minimal -y
24+
istioctl install --set profile=minimal --set tag="$ISTIO_TAG" -y
2425
fi
2526
kubectl -n istio-system rollout status deployment/istiod --timeout=300s
2627

‎05-spiffe-spire-envoy/README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,6 @@ Pod spire-agent (DS) spire-server
4141
./run.sh
4242
```
4343

44-
About 3 minutes. Expected output: [`expected/output.txt`](./expected/output.txt).
45-
4644
## Cleanup
4745

4846
```bash

0 commit comments

Comments
 (0)