auto docker publishing, helm

Author: TheTechromancer

helm/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: mongodb
   repository: https://charts.bitnami.com/bitnami
-  version: 18.6.0
+  version: 18.6.1
 - name: redis
   repository: https://charts.bitnami.com/bitnami
   version: 23.2.12
-digest: sha256:64bc4ed850429ba21e8274fad0bc986ddf5c1545b6777932b8df9a684c7d0dfa
-generated: "2026-02-20T14:00:32.835773574-05:00"
+digest: sha256:b7c9095489913f065ee0cca4ec6aee1b320e07fd089f693360d42501a1220615
+generated: "2026-02-25T16:20:43.56532327-05:00"

helm/templates/secrets.yaml

@@ -15,6 +15,6 @@ data:
   {{- if .Values.secrets.apiKey }}
   api-key: {{ .Values.secrets.apiKey | b64enc }}
   {{- else }}
-  api-key: {{ randAlphaNum 32 | b64enc }}
+  api-key: {{ uuidv4 | b64enc }}
   {{- end }}
 {{- end }}

helm/templates/server-deployment.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.server.enabled }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -103,3 +104,4 @@ spec:
     targetPort: {{ .Values.server.service.targetPort }}
     protocol: TCP
     name: http
+{{- end }}

helm/templates/watchdog-deployment.yaml

@@ -23,6 +23,7 @@ spec:
       imagePullSecrets:
         {{- toYaml .Values.imagePullSecrets | nindent 8 }}
       {{- end }}
+      {{- if .Values.server.enabled }}
       # Wait for the API server to become healthy before starting the watchdog
       initContainers:
       - name: wait-for-server
@@ -39,6 +40,7 @@ spec:
               sleep 5
             done
             echo "Server is healthy, starting watchdog."
+      {{- end }}
       containers:
       - name: watchdog
         securityContext:

helm/values.yaml

@@ -16,6 +16,8 @@ imagePullSecrets: []
 # Server (API)
 # =============================================================================
 server:
+  # -- Set to false to disable the API server (only deploy DBs + watchdog)
+  enabled: true
   replicas: 1
   resources: {}
   #   requests:

test_helm_deployment.py

@@ -2,6 +2,8 @@
 import unittest
 import subprocess
 import time
+import json
+import base64
 import requests
 import atexit
 from contextlib import contextmanager
@@ -12,10 +14,10 @@
 Run it like so:
 
 # all tests
-python test_helm_deployment.py
+uv run python test_helm_deployment.py
 
 # specific test
-python -m unittest test_helm_deployment.TestHelmDeployment.test_swagger_ui
+uv run python -m unittest test_helm_deployment.TestHelmDeployment.test_swagger_ui
 
 To bring up the test environment manually, run:
 
@@ -264,6 +266,91 @@ def test_swagger_ui(self):
             self.assertEqual(response.status_code, 200, "Swagger UI should return 200")
             self.assertIn("swagger-ui", response.text.lower(), "Response should contain swagger-ui")
 
+    def test_ingest_and_query_assets(self):
+        """Test ingesting events from evilcorp.json.gz and querying assets via bbctl"""
+        # Get the server pod name
+        result = self.kubectl(
+            "get",
+            "pods",
+            "-l",
+            "app=bbot-server",
+            "-o",
+            "jsonpath={.items[0].metadata.name}",
+            capture_output=True,
+        )
+        pod_name = result.stdout.strip()
+        self.assertTrue(pod_name, "Should find a server pod")
+        print(f"Server pod: {pod_name}")
+
+        # Get the API key from the kubernetes secret
+        result = self.kubectl(
+            "get",
+            "secret",
+            f"{self.release_name}-api-key",
+            "-o",
+            "jsonpath={.data.api-key}",
+            capture_output=True,
+        )
+        api_key = base64.b64decode(result.stdout).decode()
+        self.assertTrue(api_key, "Should retrieve API key from secret")
+
+        # Write a bbctl config file inside the pod
+        server_url = f"http://{self.release_name}-server:8807/v1/"
+        config_content = f'url: "{server_url}"\napi_keys:\n  - "{api_key}"'
+        self.kubectl(
+            "exec",
+            pod_name,
+            "--",
+            "sh",
+            "-c",
+            f"printf '%s\\n' '{config_content}' > /tmp/bbctl.yaml",
+        )
+        bbctl = "bbctl --no-color --config /tmp/bbctl.yaml"
+
+        # Copy test data into the pod
+        self.kubectl("cp", "tests/evilcorp.json.gz", f"{pod_name}:/tmp/evilcorp.json.gz")
+
+        # Ingest events using bbctl
+        print("Ingesting events...")
+        result = self.kubectl(
+            "exec",
+            pod_name,
+            "--",
+            "sh",
+            "-c",
+            f"gunzip -c /tmp/evilcorp.json.gz | {bbctl} event ingest",
+            capture_output=True,
+            timeout=120,
+        )
+        print(f"Ingest stdout: {result.stdout}")
+        print(f"Ingest stderr: {result.stderr}")
+        self.assertEqual(result.returncode, 0, f"Event ingest failed: {result.stderr}")
+
+        # Wait for the watchdog to process events into assets
+        print("Waiting for watchdog to process events into assets...")
+        assets = []
+        for i in range(30):
+            result = self.kubectl(
+                "exec",
+                pod_name,
+                "--",
+                "sh",
+                "-c",
+                f"{bbctl} asset list --json",
+                capture_output=True,
+                check=False,
+                timeout=30,
+            )
+            if result.returncode == 0 and result.stdout.strip():
+                assets = [json.loads(line) for line in result.stdout.strip().splitlines() if line.strip()]
+                if assets:
+                    break
+            print(f"  Attempt {i + 1}/30: {len(assets)} assets so far...")
+            time.sleep(2)
+
+        print(f"Found {len(assets)} assets")
+        self.assertGreater(len(assets), 0, "Should have ingested some assets from evilcorp.json.gz")
+
     def tearDown(self):
         """If a test fails, dump cluster debug info"""
         failed = False