From 76df3053f460f5554494ca94ca385e67d35059f5 Mon Sep 17 00:00:00 2001 From: Nichenametla Hima Sree Date: Tue, 18 Nov 2025 10:11:59 +0530 Subject: [PATCH 1/5] feat: adds scorecard certifier deployment and service account Signed-off-by: Nichenametla Hima Sree --- .../scorecard-certifier-deployment.yaml | 90 +++++++++++++++++++ .../templates/scorecard-certifier-sa.yaml | 19 ++++ .../scorecard-certifier_deployment_test.yaml | 90 +++++++++++++++++++ .../guac/tests/serviceaccount_all_test.yaml | 1 + charts/guac/tests/values_combine.yaml | 7 ++ charts/guac/tests/values_digest_and_tag.yaml | 3 + 6 files changed, 210 insertions(+) create mode 100644 charts/guac/templates/scorecard-certifier-deployment.yaml create mode 100644 charts/guac/templates/scorecard-certifier-sa.yaml create mode 100644 charts/guac/tests/scorecard-certifier_deployment_test.yaml diff --git a/charts/guac/templates/scorecard-certifier-deployment.yaml b/charts/guac/templates/scorecard-certifier-deployment.yaml new file mode 100644 index 0000000..4b8f5f9 --- /dev/null +++ b/charts/guac/templates/scorecard-certifier-deployment.yaml @@ -0,0 +1,90 @@ +# Copyright Kusari, Inc. and GUAC contributors +# Licensed under the MIT license. See LICENSE file in the project root for details. +{{ if .Values.guac.scorecardCertifier.enabled }} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Values.guac.scorecardCertifier.name }} +{{- if .Values.guac.scorecardCertifier.annotations }} + annotations: +{{ toYaml .Values.guac.scorecardCertifier.annotations | indent 4 }} +{{- end }} + labels: + {{- include "guac.labels" . | nindent 4 }} + app.kubernetes.io/name: {{ .Values.guac.scorecardCertifier.name }} + app.kubernetes.io/component: {{ .Values.guac.scorecardCertifier.name }} +spec: + replicas: {{ .Values.guac.scorecardCertifier.replicas }} + selector: + matchLabels: + {{- include "guac.selectorLabels" . | nindent 6 }} + app.kubernetes.io/name: {{ .Values.guac.scorecardCertifier.name }} + app.kubernetes.io/component: {{ .Values.guac.scorecardCertifier.name }} + template: + metadata: + labels: + {{- include "guac.selectorLabels" . | nindent 8 }} + app.kubernetes.io/name: {{ .Values.guac.scorecardCertifier.name }} + app.kubernetes.io/component: {{ .Values.guac.scorecardCertifier.name }} + spec: + serviceAccountName: {{ .Values.guac.scorecardCertifier.name }} + containers: + - name: {{ .Values.guac.scorecardCertifier.name }} + {{- if .Values.guac.guacImage.digest }} + image: "{{ .Values.guac.guacImage.repository }}@{{ .Values.guac.guacImage.digest }}" + {{- else }} + image: "{{ .Values.guac.guacImage.repository }}:{{ .Values.guac.guacImage.tag | default .Chart.AppVersion}}" + {{- end }} + imagePullPolicy: "{{ .Values.guac.guacImage.pullPolicy }}" + command: +{{ toYaml .Values.guac.scorecardCertifier.image.command | indent 10 }} + workingDir: {{ .Values.guac.guacImage.workingDir }} +{{- if .Values.guac.scorecardCertifier.ports }} + ports: +{{ toYaml .Values.guac.scorecardCertifier.image.ports | indent 10 }} +{{- end }} +{{- if .Values.guac.scorecardCertifier.resources }} + resources: {{- toYaml .Values.guac.scorecardCertifier.resources | nindent 10 }} +{{- end }} + + volumeMounts: + - name: guac-config + mountPath: {{ .Values.guac.guacImage.workingDir }} + readOnly: true + +{{- if or .Values.guac.common.env .Values.guac.scorecardCertifier.env }} + env: +{{- if .Values.guac.common.env }} +{{ toYaml .Values.guac.common.env | indent 10 }} +{{- end }} +{{- if .Values.guac.scorecardCertifier.env }} +{{ toYaml .Values.guac.scorecardCertifier.env | indent 10 }} +{{- end }} +{{- end }} + +{{- if .Values.imagePullSecrets }} + imagePullSecrets: +{{ toYaml .Values.imagePullSecrets | indent 8 }} +{{- end }} + volumes: + - name: guac-config + configMap: + name: guac-cm +{{- if .Values.guac.scorecardCertifier.nodeSelector }} + nodeSelector: +{{ toYaml .Values.guac.scorecardCertifier.nodeSelector | indent 8 }} +{{- end }} + +{{- if or .Values.guac.common.tolerations .Values.guac.scorecardCertifier.tolerations }} + tolerations: +{{- if .Values.guac.common.tolerations }} +{{ toYaml .Values.guac.common.tolerations | indent 8 }} +{{- end }} +{{- if .Values.guac.scorecardCertifier.tolerations }} +{{ toYaml .Values.guac.scorecardCertifier.tolerations | indent 8 }} +{{- end }} +{{- end }} + + +{{- end }} diff --git a/charts/guac/templates/scorecard-certifier-sa.yaml b/charts/guac/templates/scorecard-certifier-sa.yaml new file mode 100644 index 0000000..57637f5 --- /dev/null +++ b/charts/guac/templates/scorecard-certifier-sa.yaml @@ -0,0 +1,19 @@ +# Copyright Kusari, Inc. and GUAC contributors +# Licensed under the MIT license. See LICENSE file in the project root for details. +{{ if .Values.guac.scorecardCertifier.enabled }} +{{ if .Values.guac.scorecardCertifier.serviceAccount.create }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .Values.guac.scorecardCertifier.name }} +{{- if .Values.guac.scorecardCertifier.annotations }} + annotations: +{{ toYaml .Values.guac.scorecardCertifier.serviceAccount.annotations | indent 4 }} +{{- end }} + labels: + {{- include "guac.labels" . | nindent 4 }} + app.kubernetes.io/name: {{ .Values.guac.scorecardCertifier.name }} + app.kubernetes.io/component: {{ .Values.guac.scorecardCertifier.name }} +{{- end }} +{{- end }} diff --git a/charts/guac/tests/scorecard-certifier_deployment_test.yaml b/charts/guac/tests/scorecard-certifier_deployment_test.yaml new file mode 100644 index 0000000..0035942 --- /dev/null +++ b/charts/guac/tests/scorecard-certifier_deployment_test.yaml @@ -0,0 +1,90 @@ +# Copyright Kusari, Inc. and GUAC contributors +# Licensed under the MIT license. See LICENSE file in the project root for details. +suite: Scorecard Certifier Deployment tests +templates: + - scorecard-certifier-deployment.yaml + +tests: + - it: deployment should render + asserts: + - isKind: + of: Deployment + - hasDocuments: + count: 1 + + - it: should run the scorecardCertifier image + values: + - ./values_digest_and_tag.yaml + asserts: + - equal: + path: spec.template.spec.containers[0].name + value: scorecard-certifier + - equal: + path: spec.template.spec.containers[0].image + value: ghcr.io/guacsec/guac@sha256:167e823f36e268f66b12a79d4c4b39df23c2f87847817c161b6c6ddbc9ee5c4e + + - it: should run the scorecardCertifier sub command + values: + - ./values_digest_and_tag.yaml + asserts: + - equal: + path: spec.template.spec.containers[0].command[0] + value: "sh" + - equal: + path: spec.template.spec.containers[0].command[1] + value: "-c" + - equal: + path: spec.template.spec.containers[0].command[2] + value: "/opt/guac/guaccollect scorecard" + + - it: should respect spec level parameters + values: + - ./values_digest_and_tag.yaml + asserts: + - equal: + path: spec.replicas + value: 1 + - equal: + path: spec.selector.matchLabels["app.kubernetes.io/name"] + value: scorecard-certifier + - equal: + path: spec.template.metadata.labels["app.kubernetes.io/name"] + value: scorecard-certifier + + - it: should use tag if only tag is specified + values: + - ./values_tag_no_digest.yaml + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: ghcr.io/guacsec/guac:latest + + - it: should include tolerations + values: + - ./values_combine.yaml + asserts: + - equal: + path: spec.template.spec.tolerations[0].key + value: "kusari.cloud/common" + - equal: + path: spec.template.spec.tolerations[0].value + value: common + - equal: + path: spec.template.spec.tolerations[0].effect + value: NoSchedule + - equal: + path: spec.template.spec.tolerations[0].operator + value: Equal + + - equal: + path: spec.template.spec.tolerations[1].key + value: "kusari.cloud/own" + - equal: + path: spec.template.spec.tolerations[1].value + value: own + - equal: + path: spec.template.spec.tolerations[1].effect + value: NoSchedule + - equal: + path: spec.template.spec.tolerations[1].operator + value: Equal diff --git a/charts/guac/tests/serviceaccount_all_test.yaml b/charts/guac/tests/serviceaccount_all_test.yaml index 2559f05..70f23f7 100644 --- a/charts/guac/tests/serviceaccount_all_test.yaml +++ b/charts/guac/tests/serviceaccount_all_test.yaml @@ -9,6 +9,7 @@ templates: - ingestor-sa.yaml - oci-collector-sa.yaml - osv-certifier-sa.yaml + - scorecard-certifier-sa.yaml tests: - it: should not create service account diff --git a/charts/guac/tests/values_combine.yaml b/charts/guac/tests/values_combine.yaml index 160f32e..1d6402c 100644 --- a/charts/guac/tests/values_combine.yaml +++ b/charts/guac/tests/values_combine.yaml @@ -71,3 +71,10 @@ guac: key: kusari.cloud/own operator: Equal value: own + + scorecardCertifier: + tolerations: + - effect: NoSchedule + key: kusari.cloud/own + operator: Equal + value: own diff --git a/charts/guac/tests/values_digest_and_tag.yaml b/charts/guac/tests/values_digest_and_tag.yaml index b65b665..39e513b 100644 --- a/charts/guac/tests/values_digest_and_tag.yaml +++ b/charts/guac/tests/values_digest_and_tag.yaml @@ -31,3 +31,6 @@ guac: ingestor: name: ingestor + + scorecardCertifier: + name: scorecard-certifier From c8fe854383c4fee3f281317fc8ec2e7f081a823f Mon Sep 17 00:00:00 2001 From: Nichenametla Hima Sree Date: Tue, 18 Nov 2025 10:41:05 +0530 Subject: [PATCH 2/5] feat: modify chart version 0.7.0 Signed-off-by: Nichenametla Hima Sree --- charts/guac/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/guac/Chart.yaml b/charts/guac/Chart.yaml index a03c359..f9fec70 100644 --- a/charts/guac/Chart.yaml +++ b/charts/guac/Chart.yaml @@ -9,7 +9,7 @@ maintainers: email: guac-info@kusari.dev type: application -version: 0.6.2 +version: 0.7.0 appVersion: "v0.14.0" dependencies: From 162a091bb492d756affe447c2c6480926fa8aab7 Mon Sep 17 00:00:00 2001 From: Nichenametla Hima Sree Date: Thu, 20 Nov 2025 09:58:35 +0530 Subject: [PATCH 3/5] feat: adds scorecard certifier in values Signed-off-by: Nichenametla Hima Sree --- charts/guac/values.yaml | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/charts/guac/values.yaml b/charts/guac/values.yaml index 43e926c..f7cffa1 100644 --- a/charts/guac/values.yaml +++ b/charts/guac/values.yaml @@ -66,6 +66,17 @@ imagePullSecrets: ## @param guac.cdCertifier.serviceAccount.create - whether to create cdCertifier service account ## @param guac.cdCertifier.serviceAccount.annotations - CD Certifier service account annotations ## @param guac.cdCertifier.resources - [map] resource requests or limits of the cd Certifier deployment +## @param guac.scorecardCertifier.enabled String Whether to deploy Scorecard Certifier +## @param guac.scorecardCertifier.name String Name of the Scorecard Certifier component. +## @param guac.scorecardCertifier.annotations.reloader.stakater.com/auto [string] Boolean for deploying [stakater/Reloader] (https://github.com/stakater/Reloader) +## @param guac.scorecardCertifier.replicas Number of replicas for Scorecard Certifier deployment +## @param guac.scorecardCertifier.image.command Command for the Scorecard Certifier image. It is not recommended to override this. +## @param guac.scorecardCertifier.env Environment variables for Scorecard Certifier. Note: GITHUB_AUTH_TOKEN is required and should be provided via secretKeyRef. +## @param guac.scorecardCertifier.nodeSelector - sets the node selector for where to run the deployment +## @param guac.scorecardCertifier.tolerations +## @param guac.scorecardCertifier.serviceAccount.create - whether to create scorecardCertifier service account +## @param guac.scorecardCertifier.serviceAccount.annotations - Scorecard Certifier service account annotations +## @param guac.scorecardCertifier.resources - [map] resource requests or limits of the Scorecard Certifier deployment ## @param guac.ingestor.enabled String Whether to deploy Ingestor ## @param guac.ingestor.name String Name of the ingestor component. ## @param guac.ingestor.annotations.reloader.stakater.com/auto [string] Boolean for deploying [stakater/Reloader] (https://github.com/stakater/Reloader) @@ -272,6 +283,34 @@ guac: # cpu: "0.25" # memory: "0.5G" + scorecardCertifier: + enabled: true + name: scorecard-certifier + annotations: + reloader.stakater.com/auto: "true" + replicas: 1 + image: + command: ['sh', '-c', '/opt/guac/guaccollect scorecard'] + # GITHUB_AUTH_TOKEN is required for scorecard certifier to fetch scorecards from GitHub + # Users should create a Kubernetes secret with their GitHub token and reference it here + # Example: + # kubectl create secret generic github-token --from-literal=token= + env: + - name: GITHUB_AUTH_TOKEN + valueFrom: + secretKeyRef: + name: github-token + key: token + nodeSelector: {} + tolerations: [] + serviceAccount: + create: true + annotations: {} + resources: {} + # requests: + # cpu: "0.25" + # memory: "0.5G" + ingestor: enabled: true name: ingestor From 8f712d3945e4b5017d234317294eb63a6232c5b3 Mon Sep 17 00:00:00 2001 From: Nichenametla Hima Sree Date: Mon, 24 Nov 2025 16:56:20 +0530 Subject: [PATCH 4/5] feat: disable scorecard certifier by default Signed-off-by: Nichenametla Hima Sree --- charts/guac/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/guac/values.yaml b/charts/guac/values.yaml index f7cffa1..8f4a5a3 100644 --- a/charts/guac/values.yaml +++ b/charts/guac/values.yaml @@ -284,7 +284,7 @@ guac: # memory: "0.5G" scorecardCertifier: - enabled: true + enabled: false name: scorecard-certifier annotations: reloader.stakater.com/auto: "true" From a6273c90bdb09c7e7b2d6026c33d2384fb73b494 Mon Sep 17 00:00:00 2001 From: Nichenametla Hima Sree Date: Thu, 11 Dec 2025 10:14:28 +0530 Subject: [PATCH 5/5] fix: tests and updates guac version wrt sha Signed-off-by: Nichenametla Hima Sree --- charts/guac/tests/scorecard-certifier_deployment_test.yaml | 2 ++ charts/guac/tests/values_combine.yaml | 1 + charts/guac/tests/values_digest_and_tag.yaml | 4 +++- charts/guac/tests/values_serviceaccount_all.yaml | 5 +++++ charts/guac/tests/values_tag_no_digest.yaml | 4 ++++ 5 files changed, 15 insertions(+), 1 deletion(-) diff --git a/charts/guac/tests/scorecard-certifier_deployment_test.yaml b/charts/guac/tests/scorecard-certifier_deployment_test.yaml index 0035942..d04a64e 100644 --- a/charts/guac/tests/scorecard-certifier_deployment_test.yaml +++ b/charts/guac/tests/scorecard-certifier_deployment_test.yaml @@ -6,6 +6,8 @@ templates: tests: - it: deployment should render + values: + - ./values_digest_and_tag.yaml asserts: - isKind: of: Deployment diff --git a/charts/guac/tests/values_combine.yaml b/charts/guac/tests/values_combine.yaml index 1d6402c..aee49a7 100644 --- a/charts/guac/tests/values_combine.yaml +++ b/charts/guac/tests/values_combine.yaml @@ -73,6 +73,7 @@ guac: value: own scorecardCertifier: + enabled: true tolerations: - effect: NoSchedule key: kusari.cloud/own diff --git a/charts/guac/tests/values_digest_and_tag.yaml b/charts/guac/tests/values_digest_and_tag.yaml index 39e513b..9b2be0c 100644 --- a/charts/guac/tests/values_digest_and_tag.yaml +++ b/charts/guac/tests/values_digest_and_tag.yaml @@ -6,7 +6,8 @@ imagePullSecrets: guac: guacImage: repository: ghcr.io/guacsec/guac - tag: "latest" + tag: "v0.1.1" + # digest corresponds to guac v0.1.1 digest: "sha256:167e823f36e268f66b12a79d4c4b39df23c2f87847817c161b6c6ddbc9ee5c4e" workingDir: /guac @@ -33,4 +34,5 @@ guac: name: ingestor scorecardCertifier: + enabled: true name: scorecard-certifier diff --git a/charts/guac/tests/values_serviceaccount_all.yaml b/charts/guac/tests/values_serviceaccount_all.yaml index 480cc51..b951d98 100644 --- a/charts/guac/tests/values_serviceaccount_all.yaml +++ b/charts/guac/tests/values_serviceaccount_all.yaml @@ -37,3 +37,8 @@ guac: visualizer: serviceAccount: create: true + + scorecardCertifier: + enabled: true + serviceAccount: + create: true diff --git a/charts/guac/tests/values_tag_no_digest.yaml b/charts/guac/tests/values_tag_no_digest.yaml index f15d1af..3fdf577 100644 --- a/charts/guac/tests/values_tag_no_digest.yaml +++ b/charts/guac/tests/values_tag_no_digest.yaml @@ -31,3 +31,7 @@ guac: graphqlServer: name: graphql-server + + scorecardCertifier: + enabled: true + name: scorecard-certifier