mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 11:49:28 +00:00
Marius CiepluchandClaude Fable 5.1
8eac1b2c69
ops/k8s/profiles/kind.toml and k3s.toml hold the values that differ per cluster (exec, kube_context, registry, images, router_url, ax_server, memory, atespace, snapshots_bucket, image_pull_secret, pools); kind-images.json carries the digest pin ops/ax/up.sh wrote. load_profile() reads OUSAST_PLANE_PROFILE (name or path, default kind), applies OUSAST_<FIELD> and OUSAST_POOL_<NAME>_<FIELD>, and refuses an unknown key, a credential-shaped key or value, an exec outside local|remote and an images file without digest pins. `python -m openultrasast.plane.profile --print FIELD` serves shell scripts. The module-audit manifest is regenerated for the new module (counts 147/5, no orphan). Gates: pytest full suite 2002 passed, 1 failed (the module-audit manifest, fixed by regenerating it; tests/test_module_audit.py re-run exit 0), ruff check 0, ruff format 0, mypy 0. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
26 lines
1.6 KiB
TOML
26 lines
1.6 KiB
TOML
# The kind profile: the plane on this laptop's single-node kind cluster, which ops/ax/up.sh creates and which is
|
|
# the development default (plane-on-kubernetes design section 1). Values only; a credential never goes here
|
|
# (keys stay in the environment or .env). Every field is overridable by OUSAST_<FIELD> in the environment, a pool
|
|
# by OUSAST_POOL_<NAME>_<FIELD>. This file may name the kind cluster; the code must not (tests/test_plane_literals.py).
|
|
|
|
exec = "local" # the reconciler runs on this host against the cluster below
|
|
kube_context = "kind-ousast" # kind's context for KIND_CLUSTER_NAME=ousast
|
|
registry = "localhost:5001" # the kind-local registry up.sh creates (Substrate rewrites it for the node)
|
|
images = "kind-images.json" # digest-pinned image references, written by up.sh after each build
|
|
router_url = "" # empty: port-forward to atenet-router through the kube context (ax-tunnel)
|
|
ax_server = "" # empty: the ax CLI's own tunnel through the kube context (ax-tunnel)
|
|
memory = "s3://sast-memory" # the memory store; S3_ENDPOINT and the keys come from .env
|
|
atespace = "default"
|
|
snapshots_bucket = "s3://ax-snapshots" # ax's AX_SNAPSHOTS_BUCKET, ours (rendered into the ax-server patch)
|
|
image_pull_secret = "" # the kind registry needs none
|
|
|
|
[pools.default] # ousast-pool: two gVisor workers fit the 7 GB host beside the control planes
|
|
replicas = 2
|
|
cpu = "1"
|
|
memory = "1536Mi"
|
|
|
|
[pools.engine] # engine-pool (design section 4): one worker for the Joern engine task
|
|
replicas = 1
|
|
cpu = "2"
|
|
memory = "4Gi"
|