Require registered upload hotkeys in production Helm

Author: echobt

deploy/helm/platform/templates/_helpers.tpl

@@ -24,6 +24,9 @@ helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
 {{- if .Values.imageAutoUpdate.enabled -}}
 {{- fail "production policy rejects imageAutoUpdate.enabled=true" -}}
 {{- end -}}
+{{- if not .Values.masterProxy.uploadRequireRegisteredHotkey -}}
+{{- fail "production policy requires masterProxy.uploadRequireRegisteredHotkey=true" -}}
+{{- end -}}
 {{- if .Values.autoUpgrade.enabled -}}
 {{- if eq .Values.autoUpgrade.githubRef "main" -}}
 {{- fail "autoUpgrade.githubRef must be immutable in production" -}}

deploy/helm/platform/templates/configmap.yaml

@@ -36,6 +36,7 @@ data:
       admin_port: {{ .Values.masterAdmin.port }}
       proxy_host: "0.0.0.0"
       proxy_port: {{ .Values.masterProxy.port }}
+      upload_require_registered_hotkey: {{ .Values.masterProxy.uploadRequireRegisteredHotkey }}
     docker:
       broker_host: "0.0.0.0"
       broker_port: {{ .Values.broker.port }}

deploy/helm/platform/values.production.example.yaml

@@ -62,6 +62,7 @@ masterAdmin:
 
 masterProxy:
   replicas: 2
+  uploadRequireRegisteredHotkey: true
   autoscaling:
     enabled: true
     minReplicas: 2

deploy/helm/platform/values.yaml

@@ -139,6 +139,7 @@ masterAdmin:
 masterProxy:
   replicas: 2
   port: 8080
+  uploadRequireRegisteredHotkey: true
   resources:
     requests:
       cpu: 250m

tests/unit/test_helm_chart.py

@@ -123,6 +123,54 @@ def test_helm_template_renders_validator_registry_url_default_and_override(
         assert config["master"]["registry_url"] == "http://platform-admin:8000"
 
 
+def test_helm_master_upload_registration_defaults_to_required() -> None:
+    documents = _helm_template("platform", str(CHART))
+    config = yaml.safe_load(
+        _document(documents, "ConfigMap", "platform-config")["data"]["master.yaml"]
+    )
+
+    assert config["master"]["upload_require_registered_hotkey"] is True
+
+
+def test_helm_master_upload_registration_can_be_disabled_for_local_runtime() -> None:
+    documents = _helm_template(
+        "platform",
+        str(CHART),
+        "--set",
+        "masterProxy.uploadRequireRegisteredHotkey=false",
+    )
+    config = yaml.safe_load(
+        _document(documents, "ConfigMap", "platform-config")["data"]["master.yaml"]
+    )
+
+    assert config["master"]["upload_require_registered_hotkey"] is False
+
+
+def test_helm_production_policy_rejects_disabled_upload_registration() -> None:
+    helm = shutil.which("helm")
+    if helm is None:
+        pytest.skip("helm is not installed")
+
+    result = subprocess.run(
+        [
+            helm,
+            "template",
+            "platform",
+            str(CHART),
+            "-f",
+            str(PRODUCTION_VALUES),
+            "--set",
+            "masterProxy.uploadRequireRegisteredHotkey=false",
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+    assert result.returncode != 0
+    assert "masterProxy.uploadRequireRegisteredHotkey=true" in result.stderr
+
+
 def test_helm_validator_deployment_uses_configured_image_pull_policy() -> None:
     helm = shutil.which("helm")
     if helm is None: