laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-22 07:48:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'maint'

Browse Source
This commit is contained in:
Johnathan Corgan
2026-07-19 07:40:07 +00:00
parent 37adb13d5b 78377208af
commit ea74cd7e58
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
testing/sidecar/scripts/test-sidecar.sh
View File

@@ -256,7 +256,14 @@ fi
log "Verifying network isolation on app containers..." log "Verifying network isolation on app containers..."
for node in a b c; do for node in a b c; do
container="sidecar-${node}-app-1" container="sidecar-${node}${FIPS_CI_NAME_SUFFIX:-}-app-1"
# Fail loudly if the container is missing. Without this the two isolation
# assertions below pass vacuously: they assert a ping FAILS, and a ping into
# a non-existent container fails for the wrong reason. Only the loopback
# check, which expects success, would notice — so a naming slip here would
# silently turn the security assertions into no-ops.
docker inspect "$container" >/dev/null 2>&1 \
|| { fail "$container does not exist — isolation assertions cannot be trusted"; continue; }
# Pick a peer IP that isn't this node's own address # Pick a peer IP that isn't this node's own address
case $node in case $node in
a) peer_ip="$NODE_B_IP" ;; a) peer_ip="$NODE_B_IP" ;;
@@ -296,7 +303,7 @@ if [ "$FAILED" -gt 0 ]; then
log "Dumping logs for failed run..." log "Dumping logs for failed run..."
for node in a b c; do for node in a b c; do
echo "--- sidecar-${node} logs ---" echo "--- sidecar-${node} logs ---"
docker logs "sidecar-${node}-fips-1" 2>&1 | tail -30 docker logs "sidecar-${node}${FIPS_CI_NAME_SUFFIX:-}-fips-1" 2>&1 | tail -30
echo "" echo ""
done done
exit 1 exit 1