From 26275c6262af850de1b4c2d0e0879dba3daa61ff Mon Sep 17 00:00:00 2001 From: jwright Date: Mon, 17 Aug 2026 20:04:38 +1000 Subject: [PATCH] fix legend blurbs missed by hardening (SCC UID-range, MachineConfig SSH, readiness) + extend preflight to scan the app JS where legends inline --- pilot/assemble-arc.mjs | 6 +++++- pilot/manifest-orbit.json | 4 ++-- pilot/manifest-traffic.json | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/pilot/assemble-arc.mjs b/pilot/assemble-arc.mjs index 38ccb11..1197343 100644 --- a/pilot/assemble-arc.mjs +++ b/pilot/assemble-arc.mjs @@ -182,7 +182,11 @@ const banned = [ [/two policies renders from one field/, "subject/verb error 'renders from one field'"], [/grown-up chart/, "'grown-up chart' (use 'production-grade chart')"], ]; -for (const [re, msg] of banned) if (re.test(html)) fail.push(msg); +// legend blurbs are inlined into the app JS (the SCENES const), so scan both surfaces +const visible = html + "\n" + app; +for (const [re, msg] of banned) if (re.test(visible)) fail.push(msg); +if (/\bnever by SSH\b/.test(visible)) fail.push("obsolete 'never by SSH'"); +if (/random non-root UID/.test(visible)) fail.push("obsolete 'random non-root UID' (also check legends)"); if (fail.length) { console.error("PREFLIGHT FAILED:\n - " + fail.join("\n - ")); process.exit(1); } console.log(`site build -> ${DIST}: index.html ${(html.length / 1024).toFixed(0)}KB, rev ${BUILD_REV}, preflight OK (${appName})`); diff --git a/pilot/manifest-orbit.json b/pilot/manifest-orbit.json index e582c63..e4087b9 100644 --- a/pilot/manifest-orbit.json +++ b/pilot/manifest-orbit.json @@ -119,7 +119,7 @@ { "name": "scc", "title": "SCC", - "blurb": "Admission: what a pod may BE. restricted-v2 runs you as a random non-root UID - your image has to cope.", + "blurb": "Admission: what a pod may BE. Under the restricted SCCs a workload runs as a non-root UID from the project's allocated range, so the image must cope with an arbitrary UID.", "z": 0, "points": [ [ @@ -607,7 +607,7 @@ { "name": "machineconfig", "title": "MachineConfig", - "blurb": "The OS underneath is immutable - changed by declaration, never by SSH.", + "blurb": "Node OS configuration goes through MachineConfig declaratively; ad-hoc SSH changes create drift and are not the intended model.", "z": 0, "points": [ [ diff --git a/pilot/manifest-traffic.json b/pilot/manifest-traffic.json index da2996e..1a81cc7 100644 --- a/pilot/manifest-traffic.json +++ b/pilot/manifest-traffic.json @@ -559,7 +559,7 @@ { "name": "notready", "title": "Pod - not ready", - "blurb": "Failing readiness: silently removed. That is the feature - and the first place to look.", + "blurb": "Failing readiness: removed from the endpoint set for new Service traffic. That is the feature - and the first place to look.", "z": 0, "points": [ [