unittests

Author: shcherbak

README.md

@@ -1,6 +1,6 @@
 # keepup
 
-A lightweight Prometheus exporter that collects infrastructure inventory pushed by remote agents - OS releases, package versions (with end-of-life enrichment), and Kubernetes/Helm deployments - and exposes it as metrics.
+A lightweight Prometheus exporter that collects infrastructure inventory pushed by remote agents - package versions (with end-of-life enrichment) and Kubernetes/Helm deployments - and exposes it as metrics.
 
 `keepup` holds no state of its own: Redis is both the write buffer and the read source. Agents `PUT` JSON, `keepup` validates and stores it with a TTL, and Prometheus scrapes `/metrics` on demand.
 
@@ -10,7 +10,6 @@ A lightweight Prometheus exporter that collects infrastructure inventory pushed
 - [Quick start](#quick-start)
 - [Configuration](#configuration)
 - [API](#api)
-  - [`PUT /os-release`](#put-os-release)
   - [`PUT /package-version`](#put-package-version)
   - [`PUT /helm-cluster`](#put-helm-cluster)
 - [Metrics](#metrics)
@@ -22,18 +21,16 @@ A lightweight Prometheus exporter that collects infrastructure inventory pushed
 
 ```
  agent(s)                    keepup                        Prometheus
-┌─────────┐   PUT + token   ┌───────────────────┐  scrape  ┌────────────┐
-│ os-info │ ───────────────>│ handler ──▶ Redis  │<────────│ /metrics   │
-│ pkg-vers│                 │           (TTL)    │          │            │
-│ helm    │                 └───────────────────┘          └────────────┘
-└─────────┘
+-----------   PUT + token   ---------------------  scrape  --------------
+│ pkg-vers│ --------------->│ handler --> Redis │<---------│ /metrics   |
+│ helm    │                 │           (TTL)   │          │            │
+-----------                 ---------------------          --------------
 ```
 
 Every data domain follows the same shape:
 
 | Domain | Endpoint | Redis key | Metric |
 |---|---|---|---|
-| OS release *(deprecated)* | `PUT /os-release` | SHA1 of `{data_center}-{host_ip}` | `os_release_info` |
 | Package versions | `PUT /package-version` | SHA1 of `{data_center}-{host_ip}-PACKAGE_UUID` | `package_version_info` |
 | Kubernetes / Helm | `PUT /helm-cluster` | SHA1 of `{cluster_name}` | `kubernetes_cluster_info` |
 
@@ -58,7 +55,7 @@ docker build -f docker/Dockerfile -t keepup .
 
 The server listens on `LISTEN_PORT` (default `9101` in dev) and exposes:
 
-- `PUT`/`GET /os-release`, `/package-version`, `/helm-cluster` - data ingestion & lookup (require `x-api-token`)
+- `PUT`/`GET /package-version`, `/helm-cluster` - data ingestion & lookup (require `x-api-token`)
 - `GET /metrics` - Prometheus scrape endpoint (no auth)
 - `GET /healthcheck` - liveness probe
 
@@ -80,23 +77,6 @@ Config is loaded from environment variables. If `APP_ENV` is unset, `keepup` loa
 
 All data endpoints require an `x-api-token` header matching `API_TOKEN`, and accept both `PUT` (insert) and `GET` (lookup by `id`).
 
-### `PUT /os-release`
-
-> **Deprecated** - kept for backwards compatibility, no longer receiving new fields (e.g. `team`). Do not build new integrations against it.
-
-```jsonc
-{
-  "release": {
-    "os_id": "debian",
-    "version_codename": "bullseye",
-    "version": "11 (bullseye)",
-    "version_id": "11",
-    "data_center": "aaa",
-    "host_ip": "101.122.418.4"
-  }
-}
-```
-
 ### `PUT /package-version`
 
 ```jsonc
@@ -135,13 +115,18 @@ Unlike the other two endpoints, the request body maps directly onto the stored s
 
 | Metric | Labels |
 |---|---|
-| `os_release_info` *(deprecated)* | `id`, `os_id`, `version_codename`, `version`, `version_id`, `data_center`, `host_ip` |
 | `package_version_info` | `id`, `package_name`, `current_version`, `current_version_eof`, `newest_version`, `expired`, `data_center`, `host_ip`, `team` |
 | `kubernetes_cluster_info` | `id`, `cluster_name`, `kube_version`, `chart_name`, `chart_version`, `chart_namespace`, `team` |
 
 ## Testing
 
-There are no unit tests - only an end-to-end shell script that exercises all three endpoints against a running server:
+Unit tests cover the handler package against an in-process fake Redis ([`miniredis`](https://github.com/alicebob/miniredis)) - no external services required:
+
+```bash
+go test ./...
+```
+
+An end-to-end shell script also exercises both endpoints against a running server:
 
 ```bash
 # start the server first (see Quick start), then:

charts/keepup/Chart.yaml

@@ -2,5 +2,5 @@
 apiVersion: v2
 name: keepup
 description: eondoflife.date version tracker service
-version: 1.7.0
-appVersion: 1.6.0
+version: 1.7.1
+appVersion: 1.7.0

charts/keepup/templates/_config.yaml

@@ -5,6 +5,12 @@
       name: keepup-config
       key: APP_ENV
 
+- name: LISTEN_PORT
+  valueFrom:
+    configMapKeyRef:
+      name: keepup-config
+      key: LISTEN_PORT
+
 - name: REDIS_ADDR
   valueFrom:
     configMapKeyRef:

charts/keepup/templates/confiig.yaml

@@ -2,9 +2,9 @@ kind: ConfigMap
 apiVersion: v1
 metadata:
   name: keepup-config
-  namespace: keepup
 data:
   APP_ENV: {{ .Values.appEnv | quote }}
+  LISTEN_PORT: {{ .Values.listenPort | quote }}
   REDIS_ADDR: {{ .Values.redisAddr | quote }}
   REDIS_PORT: {{ .Values.redisPort | quote }}
   REDIS_DBNO: {{ .Values.redisDbNo | quote }}

charts/keepup/templates/deployment.yaml

@@ -22,6 +22,9 @@ spec:
         {{- toYaml .Values.annotations | nindent 8 }}
       {{- end }}
     spec:
+      {{- with .Values.podSecurityContext }}
+      securityContext: {{ toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml .Values.nodeSelector | nindent 8 }}
@@ -35,15 +38,24 @@ spec:
         - name: keepup-redis-container
           imagePullPolicy: {{ .Values.redis.pullPolicy }}
           image: {{ .Values.redis.image | quote }}
+          {{- with .Values.redis.securityContext }}
+          securityContext: {{ toYaml . | nindent 12 }}
+          {{- end }}
 {{ end }}
         - name: keepup-main-container
           imagePullPolicy: {{ .Values.main.pullPolicy }}
           image: "{{ .Values.main.image }}:{{ .Values.main.tag | default .Chart.AppVersion }}"
           env:
             {{ include "project.config" . | indent 12 }}
+          {{- with .Values.main.securityContext }}
+          securityContext: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.listenPort | int }}
           readinessProbe:
             httpGet:
               path: /healthcheck
-              port: 80
+              port: http
             initialDelaySeconds: 10
             periodSeconds: 60

charts/keepup/templates/httproute.yaml

@@ -15,9 +15,6 @@ spec:
   {{- end }}
   rules:
     - matches:
-        - path:
-            type: PathPrefix
-            value: /os-release
         - path:
             type: PathPrefix
             value: /helm-cluster

charts/keepup/templates/ingress.yaml

@@ -15,13 +15,6 @@ spec:
     - host: {{ .Values.ingress.host }}
       http:
         paths:
-          - path: /os-release
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: keepup-service
-                port:
-                  number: 80
           - path: /helm-cluster
             pathType: ImplementationSpecific
             backend:

charts/keepup/templates/seecret.yaml

@@ -2,7 +2,6 @@ kind: Secret
 apiVersion: v1
 metadata:
   name: keepup-seecret
-  namespace: keepup
 data:
   API_TOKEN: {{ .Values.apiToken | b64enc }}
 type: Opaque

charts/keepup/templates/service.yaml

@@ -14,4 +14,4 @@ spec:
     - name: http
       protocol: TCP
       port: 80
-      targetPort: 80
+      targetPort: http

charts/keepup/values.yaml

@@ -1,14 +1,32 @@
 replicas: 1
 
+podSecurityContext:
+  seccompProfile:
+    type: RuntimeDefault
+
 main:
   image: "ghcr.io/code-tool/keepup"
   tag: ""
   pullPolicy: "IfNotPresent"
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: ["ALL"]
 
 redis:
   enabled: true
   image: "redis:8.2.8"
   pullPolicy: "IfNotPresent"
+  # the official redis image's built-in non-root user
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 999
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
 
 ingress:
   enabled: true
@@ -50,6 +68,7 @@ tolerations: []
 
 apiToken: ''
 appEnv: prod
+listenPort: '9101'
 redisAddr: 127.0.0.1
 redisPort: '6379'
 redisDbNo: '7'