mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-20 16:07:11 +08:00
test(ql3): prove Kubernetes secret binding projection
This commit is contained in:
whyour
@@ -0,0 +1,259 @@
|
||||
#!/usr/bin/env node
|
||||
|
||||
'use strict';
|
||||
|
||||
const fs = require('node:fs');
|
||||
const path = require('node:path');
|
||||
|
||||
const FIXTURE = 'qinglong/plugin-package-secret-binding-kubernetes-live@v1';
|
||||
const SHA256 = /^sha256:[a-f0-9]{64}$/;
|
||||
const FORBIDDEN_KEY =
|
||||
/(secretRef|secretValue|material|assertion|jwt|password|dsn|privateKey|certificate|kubeconfig|podUid|nodeUid|podName|nodeName)/i;
|
||||
const REQUIRED_GATES = Object.freeze([
|
||||
'realThreeNodeKubernetes',
|
||||
'twoManagementReplicasOnDistinctNodes',
|
||||
'formalHttpsClientCommands',
|
||||
'planReplayedAcrossReplicas',
|
||||
'separationOfDutyDecision',
|
||||
'authorizedInspection',
|
||||
'realExecutorJob',
|
||||
'projectedSecretMetadataAccepted',
|
||||
'bindingPublishedExactlyOnce',
|
||||
'managementCannotReadSecrets',
|
||||
'managementDoesNotMountPackageValues',
|
||||
'executorCannotReadSecrets',
|
||||
'executorHasNoServiceAccountToken',
|
||||
'executorProjectionReadOnly',
|
||||
'databaseContainsNoSensitiveValue',
|
||||
'passed',
|
||||
]);
|
||||
|
||||
function exact(value, keys) {
|
||||
return Boolean(
|
||||
value &&
|
||||
typeof value === 'object' &&
|
||||
!Array.isArray(value) &&
|
||||
JSON.stringify(Object.keys(value).sort()) ===
|
||||
JSON.stringify([...keys].sort()),
|
||||
);
|
||||
}
|
||||
|
||||
function scan(value, findings, location = 'report') {
|
||||
if (Array.isArray(value)) {
|
||||
value.forEach((entry, index) =>
|
||||
scan(entry, findings, `${location}[${index}]`),
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (!value || typeof value !== 'object') return;
|
||||
for (const [key, entry] of Object.entries(value)) {
|
||||
if (FORBIDDEN_KEY.test(key))
|
||||
findings.push(`${location}.${key} is forbidden`);
|
||||
if (
|
||||
typeof entry === 'string' &&
|
||||
/(qlsecret:v1:|-----BEGIN |postgres(?:ql)?:\/\/|eyJ[A-Za-z0-9_-]+\.)/.test(
|
||||
entry,
|
||||
)
|
||||
) {
|
||||
findings.push(`${location}.${key} contains sensitive material`);
|
||||
}
|
||||
scan(entry, findings, `${location}.${key}`);
|
||||
}
|
||||
}
|
||||
|
||||
function validatePluginPackageSecretBindingKubernetesLiveReport(report) {
|
||||
const findings = [];
|
||||
if (
|
||||
!exact(report, [
|
||||
'schemaVersion',
|
||||
'fixture',
|
||||
'observedAtMs',
|
||||
'platform',
|
||||
'management',
|
||||
'review',
|
||||
'executor',
|
||||
'persistence',
|
||||
'gates',
|
||||
'limitations',
|
||||
]) ||
|
||||
report.schemaVersion !== 1 ||
|
||||
report.fixture !== FIXTURE ||
|
||||
!Number.isSafeInteger(report.observedAtMs) ||
|
||||
report.observedAtMs < 1
|
||||
) {
|
||||
findings.push('report envelope is invalid');
|
||||
}
|
||||
if (
|
||||
!exact(report.platform, [
|
||||
'architecture',
|
||||
'kubernetesVersion',
|
||||
'nodeCount',
|
||||
'postgresVersionNumber',
|
||||
'adminImageId',
|
||||
]) ||
|
||||
!['amd64', 'arm64'].includes(report.platform?.architecture) ||
|
||||
typeof report.platform?.kubernetesVersion !== 'string' ||
|
||||
report.platform?.nodeCount !== 3 ||
|
||||
report.platform?.postgresVersionNumber !== 180004 ||
|
||||
!SHA256.test(report.platform?.adminImageId ?? '')
|
||||
) {
|
||||
findings.push('platform evidence is invalid');
|
||||
}
|
||||
if (
|
||||
!exact(report.management, [
|
||||
'replicas',
|
||||
'distinctNodeHashes',
|
||||
'serviceAccountTokenMounted',
|
||||
'packageValueVolumeMounted',
|
||||
'canGetSecrets',
|
||||
'canListSecrets',
|
||||
]) ||
|
||||
report.management?.replicas !== 2 ||
|
||||
!Array.isArray(report.management?.distinctNodeHashes) ||
|
||||
report.management.distinctNodeHashes.length !== 2 ||
|
||||
new Set(report.management.distinctNodeHashes).size !== 2 ||
|
||||
!report.management.distinctNodeHashes.every((value) =>
|
||||
SHA256.test(value),
|
||||
) ||
|
||||
report.management.serviceAccountTokenMounted !== false ||
|
||||
report.management.packageValueVolumeMounted !== false ||
|
||||
report.management.canGetSecrets !== false ||
|
||||
report.management.canListSecrets !== false
|
||||
) {
|
||||
findings.push('management isolation evidence is invalid');
|
||||
}
|
||||
if (
|
||||
!exact(report.review, [
|
||||
'commands',
|
||||
'requesterSubjectHash',
|
||||
'reviewerSubjectHash',
|
||||
'distinctUsers',
|
||||
'planStatus',
|
||||
'replayStatus',
|
||||
'decisionStatus',
|
||||
'inspectionStale',
|
||||
'actionDigest',
|
||||
'planDigest',
|
||||
]) ||
|
||||
JSON.stringify(report.review?.commands) !==
|
||||
JSON.stringify([
|
||||
'plugin-package.secret-binding.plan',
|
||||
'plugin-package.secret-binding.plan',
|
||||
'plugin-package.secret-binding.propose',
|
||||
'plugin-package.secret-binding.decide',
|
||||
'plugin-package.secret-binding.inspect',
|
||||
]) ||
|
||||
!SHA256.test(report.review?.requesterSubjectHash ?? '') ||
|
||||
!SHA256.test(report.review?.reviewerSubjectHash ?? '') ||
|
||||
report.review?.requesterSubjectHash ===
|
||||
report.review?.reviewerSubjectHash ||
|
||||
report.review?.distinctUsers !== true ||
|
||||
report.review?.planStatus !== 'created' ||
|
||||
report.review?.replayStatus !== 'existing' ||
|
||||
report.review?.decisionStatus !== 'decided' ||
|
||||
report.review?.inspectionStale !== false ||
|
||||
!SHA256.test(`sha256:${report.review?.actionDigest ?? ''}`) ||
|
||||
!SHA256.test(`sha256:${report.review?.planDigest ?? ''}`)
|
||||
) {
|
||||
findings.push('review ceremony evidence is invalid');
|
||||
}
|
||||
if (
|
||||
!exact(report.executor, [
|
||||
'jobSucceeded',
|
||||
'serviceAccountTokenMounted',
|
||||
'canGetSecrets',
|
||||
'canListSecrets',
|
||||
'projectionReadOnly',
|
||||
'projectionFileCount',
|
||||
'projectionKeyHash',
|
||||
'outputSensitiveFree',
|
||||
]) ||
|
||||
report.executor?.jobSucceeded !== true ||
|
||||
report.executor?.serviceAccountTokenMounted !== false ||
|
||||
report.executor?.canGetSecrets !== false ||
|
||||
report.executor?.canListSecrets !== false ||
|
||||
report.executor?.projectionReadOnly !== true ||
|
||||
report.executor?.projectionFileCount !== 1 ||
|
||||
!SHA256.test(report.executor?.projectionKeyHash ?? '') ||
|
||||
report.executor?.outputSensitiveFree !== true
|
||||
) {
|
||||
findings.push('executor projection evidence is invalid');
|
||||
}
|
||||
if (
|
||||
!exact(report.persistence, [
|
||||
'bindingCount',
|
||||
'authorityKind',
|
||||
'evidenceDigest',
|
||||
'entryCount',
|
||||
'approvalConsumed',
|
||||
'executionSucceeded',
|
||||
'sensitiveMatchCount',
|
||||
]) ||
|
||||
report.persistence?.bindingCount !== 1 ||
|
||||
report.persistence?.authorityKind !== 'approved-action-execution' ||
|
||||
!SHA256.test(`sha256:${report.persistence?.evidenceDigest ?? ''}`) ||
|
||||
report.persistence?.entryCount !== 1 ||
|
||||
report.persistence?.approvalConsumed !== true ||
|
||||
report.persistence?.executionSucceeded !== true ||
|
||||
report.persistence?.sensitiveMatchCount !== 0
|
||||
) {
|
||||
findings.push('durable binding evidence is invalid');
|
||||
}
|
||||
if (
|
||||
!exact(report.gates, REQUIRED_GATES) ||
|
||||
REQUIRED_GATES.some((gate) => report.gates?.[gate] !== true)
|
||||
) {
|
||||
findings.push('one or more required gates are false or missing');
|
||||
}
|
||||
if (
|
||||
!Array.isArray(report.limitations) ||
|
||||
report.limitations.length !== 2 ||
|
||||
report.limitations.some(
|
||||
(value) =>
|
||||
typeof value !== 'string' || value.length < 16 || value.length > 512,
|
||||
)
|
||||
) {
|
||||
findings.push('limitations are invalid');
|
||||
}
|
||||
scan(report, findings);
|
||||
return Object.freeze({
|
||||
schemaVersion: 1,
|
||||
fixture: FIXTURE,
|
||||
findings: Object.freeze(findings),
|
||||
compatible: findings.length === 0,
|
||||
});
|
||||
}
|
||||
|
||||
function main(argv) {
|
||||
if (argv.length !== 1 || !argv[0].startsWith('--report=/')) {
|
||||
throw new Error(
|
||||
'usage: ql3-plugin-package-secret-binding-kubernetes-live-audit --report=/absolute/report.json',
|
||||
);
|
||||
}
|
||||
const reportPath = argv[0].slice('--report='.length);
|
||||
if (path.resolve(reportPath) !== reportPath)
|
||||
throw new Error('report path is invalid');
|
||||
const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
|
||||
const result = validatePluginPackageSecretBindingKubernetesLiveReport(report);
|
||||
process.stdout.write(`${JSON.stringify(result)}\n`);
|
||||
if (!result.compatible) process.exitCode = 1;
|
||||
}
|
||||
|
||||
if (require.main === module) {
|
||||
try {
|
||||
main(process.argv.slice(2));
|
||||
} catch (error) {
|
||||
process.stderr.write(
|
||||
`QL3 Secret binding Kubernetes live audit failed: ${
|
||||
error instanceof Error ? error.message : String(error)
|
||||
}\n`,
|
||||
);
|
||||
process.exitCode = 1;
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
FIXTURE,
|
||||
REQUIRED_GATES,
|
||||
validatePluginPackageSecretBindingKubernetesLiveReport,
|
||||
};
|
||||
@@ -0,0 +1,343 @@
|
||||
#!/usr/bin/env node
|
||||
|
||||
'use strict';
|
||||
|
||||
const assert = require('node:assert/strict');
|
||||
const { randomUUID } = require('node:crypto');
|
||||
const fs = require('node:fs');
|
||||
|
||||
const {
|
||||
createPostgresDatabaseOpener,
|
||||
} = require('@qinglong/cluster-postgres/package-executor');
|
||||
const {
|
||||
PostgresApprovalRequestRepository,
|
||||
} = require('@qinglong/cluster-postgres/approved-action');
|
||||
const {
|
||||
PostgresPluginPackageInstallRepository,
|
||||
} = require('@qinglong/cluster-postgres/plugin-package-install');
|
||||
const {
|
||||
PLUGIN_PACKAGE_API_VERSION,
|
||||
PLUGIN_PACKAGE_KIND,
|
||||
planPluginPackageInstall,
|
||||
} = require('@qinglong/runtime-core/plugin-package');
|
||||
const {
|
||||
pluginPackageActivationIntentDigest,
|
||||
pluginPackageInstallCommit,
|
||||
transitionPluginPackageInstall,
|
||||
} = require('@qinglong/runtime-core/plugin-package-install');
|
||||
const {
|
||||
createPluginPackagePublisherProvenance,
|
||||
} = require('@qinglong/runtime-core/plugin-package-publisher-provenance');
|
||||
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
|
||||
const {
|
||||
secretProjectionFileName,
|
||||
} = require('@qinglong/runtime-core/secret-projection');
|
||||
const {
|
||||
createClusterPluginPackageManagementService,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-management');
|
||||
const {
|
||||
createClusterPluginPackageApprovedActionDispatcher,
|
||||
} = require('@qinglong/cluster-admin/plugin-package-approved-action');
|
||||
|
||||
const PROJECT_ID = 'secret-binding-kubernetes-live';
|
||||
const PACKAGE_NAME = 'secret-binding-live';
|
||||
const REQUESTER_ID = 'secret-binding-requester';
|
||||
const REVIEWER_ID = 'secret-binding-reviewer';
|
||||
const MIGRATION_URL = process.env.QL3_TEST_POSTGRES_MIGRATION_URL;
|
||||
const MANAGER_URL = process.env.QL3_TEST_POSTGRES_PACKAGE_MANAGER_URL;
|
||||
const EXECUTOR_URL = process.env.QL3_TEST_POSTGRES_PACKAGE_EXECUTOR_URL;
|
||||
|
||||
function opener(role, connectionString) {
|
||||
assert.ok(connectionString, `${role} URL is required`);
|
||||
return createPostgresDatabaseOpener({
|
||||
role,
|
||||
connection: { connectionString, tls: { mode: 'disable' } },
|
||||
pool: { maxConnections: 2, applicationName: `ql3-live-${role}` },
|
||||
onPoolError(error) {
|
||||
throw error;
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
function principal(id, authenticationId, now) {
|
||||
return Object.freeze({
|
||||
subject: Object.freeze({ type: 'user', id }),
|
||||
authenticationId,
|
||||
authenticatedAtMs: now - 1,
|
||||
expiresAtMs: now + 120_000,
|
||||
assurance: 'multi_factor',
|
||||
});
|
||||
}
|
||||
|
||||
function audit(eventId, requestId, projectId, now, fence) {
|
||||
return Object.freeze({
|
||||
eventId,
|
||||
requestId,
|
||||
operationId: 'approval.consume',
|
||||
projectId,
|
||||
subject: Object.freeze({ type: 'system', id: 'cluster_package_executor' }),
|
||||
authenticationId: 'secret-binding-kubernetes-live-bootstrap',
|
||||
outcome: 'allowed',
|
||||
reasons: Object.freeze(['package_review']),
|
||||
fence,
|
||||
occurredAtMs: now,
|
||||
});
|
||||
}
|
||||
|
||||
async function main() {
|
||||
let now = Date.now();
|
||||
const migration = await opener('migration', MIGRATION_URL)();
|
||||
const manager = await opener('package-manager', MANAGER_URL)();
|
||||
const executor = await opener('package-executor', EXECUTOR_URL)();
|
||||
try {
|
||||
await migration.pool.query(
|
||||
`INSERT INTO "ql3"."projects" (
|
||||
id, name, slug, status, version, created_at_ms, updated_at_ms
|
||||
) VALUES ($1, $1, $1, 'active', 1, $2, $2)`,
|
||||
[PROJECT_ID, now],
|
||||
);
|
||||
await migration.pool.query(
|
||||
`INSERT INTO "ql3"."project_role_bindings" (
|
||||
project_id, subject_type, subject_id, version, state, role,
|
||||
mutation_id, changed_by_type, changed_by_id, created_at_ms
|
||||
) VALUES
|
||||
($1, 'user', $2, 1, 'active', 'owner', $4, 'system', 'live', $6),
|
||||
($1, 'user', $3, 1, 'active', 'admin', $5, 'system', 'live', $6)`,
|
||||
[
|
||||
PROJECT_ID,
|
||||
REQUESTER_ID,
|
||||
REVIEWER_ID,
|
||||
'secret-binding-live-owner',
|
||||
'secret-binding-live-reviewer',
|
||||
now,
|
||||
],
|
||||
);
|
||||
|
||||
const manifest = Object.freeze({
|
||||
apiVersion: PLUGIN_PACKAGE_API_VERSION,
|
||||
kind: PLUGIN_PACKAGE_KIND,
|
||||
metadata: {
|
||||
name: PACKAGE_NAME,
|
||||
displayName: 'Kubernetes Secret binding live fixture',
|
||||
version: '1.0.0',
|
||||
description: 'Content-free Secret binding Kubernetes evidence fixture',
|
||||
license: 'Apache-2.0',
|
||||
},
|
||||
spec: {
|
||||
compatibility: {
|
||||
qinglong: '>=3.0.0-0 <4.0.0',
|
||||
architectures: ['arm64', 'amd64'],
|
||||
deploymentProfiles: ['cluster-control'],
|
||||
},
|
||||
runtimes: [],
|
||||
resources: {
|
||||
memory: { recommended: '16Mi' },
|
||||
disk: { install: '4Mi', working: '8Mi' },
|
||||
},
|
||||
permissions: {
|
||||
network: { allowedHosts: [] },
|
||||
secrets: [{ name: 'TOKEN', required: true }],
|
||||
tools: ['secret.use'],
|
||||
},
|
||||
contents: { tasks: [], workflows: [], prompts: [], tools: [] },
|
||||
},
|
||||
});
|
||||
const environment = Object.freeze({
|
||||
qinglongVersion: '3.0.0-alpha.0',
|
||||
architecture: process.arch === 'x64' ? 'amd64' : 'arm64',
|
||||
deploymentProfile: 'cluster-control',
|
||||
runtimes: [],
|
||||
availableMemoryBytes: 128 * 1024 * 1024,
|
||||
availableDiskBytes: 256 * 1024 * 1024,
|
||||
});
|
||||
const plan = planPluginPackageInstall(manifest, environment);
|
||||
const actionInput = Object.freeze({
|
||||
lockId: 'secret-binding-live-lock',
|
||||
projectId: PROJECT_ID,
|
||||
manifest,
|
||||
plan,
|
||||
environment,
|
||||
source: {
|
||||
kind: 'offline',
|
||||
locator: `offline:sha256:${'a'.repeat(64)}`,
|
||||
artifactDigest: 'a'.repeat(64),
|
||||
artifactBytes: 2048,
|
||||
contentDigest: 'b'.repeat(64),
|
||||
},
|
||||
architecture: environment.architecture,
|
||||
deploymentProfile: 'cluster-control',
|
||||
targetGeneration: 1,
|
||||
});
|
||||
const actionRef = `install:${PACKAGE_NAME}:v1`;
|
||||
const approvalId = 'secret-binding-live-install-approval';
|
||||
const management = createClusterPluginPackageManagementService({
|
||||
pool: manager.pool,
|
||||
now: () => now,
|
||||
approvalLifetimeMs: 120_000,
|
||||
});
|
||||
const proposed = await management.propose({
|
||||
actionRef,
|
||||
approvalRequestId: approvalId,
|
||||
proposalAuditEventId: randomUUID(),
|
||||
approvalAuditEventId: randomUUID(),
|
||||
requestedAtMs: now,
|
||||
actionInput,
|
||||
principal: principal(REQUESTER_ID, 'bootstrap-requester', now),
|
||||
});
|
||||
now += 10;
|
||||
const decided = await management.decide({
|
||||
approvalRequestId: approvalId,
|
||||
expectedVersion: proposed.approvalRequest.version,
|
||||
decisionId: 'secret-binding-live-install-decision',
|
||||
auditEventId: randomUUID(),
|
||||
decision: 'approved',
|
||||
reasonCode: 'reviewed',
|
||||
decidedAtMs: now,
|
||||
principal: principal(REVIEWER_ID, 'bootstrap-reviewer', now),
|
||||
});
|
||||
const fence = Object.freeze({ projectVersion: 1, bindingVersion: 1 });
|
||||
now += 10;
|
||||
const consumed = await new PostgresApprovalRequestRepository(
|
||||
executor.pool,
|
||||
).consume({
|
||||
requestId: approvalId,
|
||||
expectedVersion: decided.request.version,
|
||||
consumptionId: 'secret-binding-live-install-consume',
|
||||
dispatchId: 'secret-binding-live-install-dispatch',
|
||||
action: decided.request.action,
|
||||
requestedBy: Object.freeze({ type: 'user', id: REQUESTER_ID }),
|
||||
consumedBy: Object.freeze({
|
||||
type: 'system',
|
||||
id: 'cluster_package_executor',
|
||||
}),
|
||||
consumedAtMs: now,
|
||||
authorizationFence: fence,
|
||||
audit: audit(randomUUID(), approvalId, PROJECT_ID, now, fence),
|
||||
});
|
||||
assert.equal(consumed.status, 'consumed');
|
||||
let id = 0;
|
||||
now += 10;
|
||||
const dispatched = await createClusterPluginPackageApprovedActionDispatcher(
|
||||
{
|
||||
pool: executor.pool,
|
||||
owner: 'secret-binding-live-bootstrap',
|
||||
clock: () => now,
|
||||
createId: () => `secret-binding-live-bootstrap-${++id}`,
|
||||
secretExistenceInspector: { async assertExists() {} },
|
||||
},
|
||||
).dispatchBatch({ limit: 4 });
|
||||
assert.equal(dispatched.succeeded, 1);
|
||||
|
||||
const installs = new PostgresPluginPackageInstallRepository(executor.pool);
|
||||
const queued = await installs.find(PROJECT_ID, PACKAGE_NAME);
|
||||
assert.ok(queued);
|
||||
const lock = await installs.findLock(queued.lockDigest);
|
||||
assert.ok(lock);
|
||||
now += 10;
|
||||
const staged = transitionPluginPackageInstall(lock, queued, {
|
||||
type: 'stage_completed',
|
||||
mutationId: 'secret-binding-live-stage',
|
||||
occurredAtMs: now,
|
||||
stageRef: `stage:${lock.lockDigest}`,
|
||||
artifactDigest: lock.source.artifactDigest,
|
||||
manifestDigest: lock.manifestDigest,
|
||||
contentDigest: lock.source.contentDigest,
|
||||
evidenceDigest: 'c'.repeat(64),
|
||||
});
|
||||
const provenance = createPluginPackagePublisherProvenance({
|
||||
projectId: PROJECT_ID,
|
||||
packageName: PACKAGE_NAME,
|
||||
installationId: queued.installationId,
|
||||
lockDigest: lock.lockDigest,
|
||||
artifactDigest: staged.stageReceipt.artifactDigest,
|
||||
manifestDigest: staged.stageReceipt.manifestDigest,
|
||||
contentDigest: staged.stageReceipt.contentDigest,
|
||||
stageEvidenceDigest: staged.stageReceipt.evidenceDigest,
|
||||
signature: {
|
||||
publisher: 'live.qinglong.test',
|
||||
keyId: 'live-key-1',
|
||||
signatureDigest: 'd'.repeat(64),
|
||||
keyNotBeforeMs: now - 1,
|
||||
keyNotAfterMs: now + 120_000,
|
||||
verifiedAtMs: now,
|
||||
},
|
||||
});
|
||||
await executor.pool.query(
|
||||
`INSERT INTO "ql3"."plugin_package_publisher_provenance" (
|
||||
installation_id, project_id, package_name, lock_digest,
|
||||
artifact_digest, manifest_digest, content_digest,
|
||||
stage_evidence_digest, publisher, key_id, signature_digest,
|
||||
key_not_before_ms, key_not_after_ms, verified_at_ms,
|
||||
provenance_digest, provenance_json
|
||||
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16::jsonb)`,
|
||||
[
|
||||
provenance.installationId,
|
||||
provenance.projectId,
|
||||
provenance.packageName,
|
||||
provenance.lockDigest,
|
||||
provenance.artifactDigest,
|
||||
provenance.manifestDigest,
|
||||
provenance.contentDigest,
|
||||
provenance.stageEvidenceDigest,
|
||||
provenance.publisher,
|
||||
provenance.keyId,
|
||||
provenance.signatureDigest,
|
||||
provenance.keyNotBeforeMs,
|
||||
provenance.keyNotAfterMs,
|
||||
provenance.verifiedAtMs,
|
||||
provenance.provenanceDigest,
|
||||
JSON.stringify(provenance),
|
||||
],
|
||||
);
|
||||
await installs.commit(pluginPackageInstallCommit(queued, staged));
|
||||
now += 10;
|
||||
const activating = transitionPluginPackageInstall(lock, staged, {
|
||||
type: 'activation_started',
|
||||
mutationId: 'secret-binding-live-activate',
|
||||
occurredAtMs: now,
|
||||
});
|
||||
await installs.commit(pluginPackageInstallCommit(staged, activating));
|
||||
now += 10;
|
||||
const active = transitionPluginPackageInstall(lock, activating, {
|
||||
type: 'activation_committed',
|
||||
mutationId: 'secret-binding-live-commit',
|
||||
occurredAtMs: now,
|
||||
activationRef: `active:${lock.lockDigest}`,
|
||||
intentDigest: pluginPackageActivationIntentDigest(lock, activating),
|
||||
generation: 1,
|
||||
contentDigest: lock.source.contentDigest,
|
||||
});
|
||||
await installs.commit(pluginPackageInstallCommit(activating, active));
|
||||
|
||||
const secretRef = createSecretRef({
|
||||
projectId: PROJECT_ID,
|
||||
name: 'runtime-token',
|
||||
version: 1,
|
||||
});
|
||||
const evidence = `${JSON.stringify({
|
||||
schemaVersion: 1,
|
||||
event: 'secret_binding_prerequisite_ready',
|
||||
projectId: PROJECT_ID,
|
||||
packageName: PACKAGE_NAME,
|
||||
requesterId: REQUESTER_ID,
|
||||
reviewerId: REVIEWER_ID,
|
||||
secretRef,
|
||||
projectionKey: secretProjectionFileName(secretRef),
|
||||
installationId: active.installationId,
|
||||
generation: active.targetGeneration,
|
||||
})}\n`;
|
||||
fs.writeFileSync('/dev/termination-log', evidence);
|
||||
process.stdout.write(evidence);
|
||||
} finally {
|
||||
await Promise.all([migration.close(), manager.close(), executor.close()]);
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((error) => {
|
||||
process.stderr.write(
|
||||
`QL3 Secret binding Kubernetes bootstrap failed: ${
|
||||
error instanceof Error ? error.stack || error.message : String(error)
|
||||
}\n`,
|
||||
);
|
||||
process.exitCode = 1;
|
||||
});
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user