test(ql3): prove Kubernetes secret binding projection

2026-09-20 16:07:11 +08:00 · 2026-08-13 17:44:05 +08:00
parent 73eeaed4de
commit 22eea3ac71
8 changed files with 2120 additions and 4 deletions
@@ -0,0 +1,99 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const { test } = require('node:test');
+
+const {
+  FIXTURE,
+  REQUIRED_GATES,
+  validatePluginPackageSecretBindingKubernetesLiveReport,
+} = require('../../scripts/ql3-plugin-package-secret-binding-kubernetes-live-audit.cjs');
+
+function report() {
+  const digest = 'a'.repeat(64);
+  return {
+    schemaVersion: 1,
+    fixture: FIXTURE,
+    observedAtMs: 1,
+    platform: {
+      architecture: 'arm64',
+      kubernetesVersion: 'v1.34.3+k3s1',
+      nodeCount: 3,
+      postgresVersionNumber: 180004,
+      adminImageId: `sha256:${digest}`,
+    },
+    management: {
+      replicas: 2,
+      distinctNodeHashes: [
+        `sha256:${'1'.repeat(64)}`,
+        `sha256:${'2'.repeat(64)}`,
+      ],
+      serviceAccountTokenMounted: false,
+      packageValueVolumeMounted: false,
+      canGetSecrets: false,
+      canListSecrets: false,
+    },
+    review: {
+      commands: [
+        'plugin-package.secret-binding.plan',
+        'plugin-package.secret-binding.plan',
+        'plugin-package.secret-binding.propose',
+        'plugin-package.secret-binding.decide',
+        'plugin-package.secret-binding.inspect',
+      ],
+      requesterSubjectHash: `sha256:${'3'.repeat(64)}`,
+      reviewerSubjectHash: `sha256:${'4'.repeat(64)}`,
+      distinctUsers: true,
+      planStatus: 'created',
+      replayStatus: 'existing',
+      decisionStatus: 'decided',
+      inspectionStale: false,
+      actionDigest: '5'.repeat(64),
+      planDigest: '6'.repeat(64),
+    },
+    executor: {
+      jobSucceeded: true,
+      serviceAccountTokenMounted: false,
+      canGetSecrets: false,
+      canListSecrets: false,
+      projectionReadOnly: true,
+      projectionFileCount: 1,
+      projectionKeyHash: `sha256:${'7'.repeat(64)}`,
+      outputSensitiveFree: true,
+    },
+    persistence: {
+      bindingCount: 1,
+      authorityKind: 'approved-action-execution',
+      evidenceDigest: '8'.repeat(64),
+      entryCount: 1,
+      approvalConsumed: true,
+      executionSucceeded: true,
+      sensitiveMatchCount: 0,
+    },
+    gates: Object.fromEntries(REQUIRED_GATES.map((gate) => [gate, true])),
+    limitations: [
+      'single-server k3s control plane is not Kubernetes control-plane HA evidence',
+      'PostgreSQL physical failover is proven by the independent 125-gate HA contract',
+    ],
+  };
+}
+
+test('accepts one exact low-sensitive Secret binding Kubernetes report', () => {
+  assert.deepEqual(
+    validatePluginPackageSecretBindingKubernetesLiveReport(report()).findings,
+    [],
+  );
+});
+
+test('rejects false gates, topology drift and sensitive material', () => {
+  const invalid = report();
+  invalid.gates.realExecutorJob = false;
+  invalid.management.distinctNodeHashes[1] =
+    invalid.management.distinctNodeHashes[0];
+  invalid.executor.secretRef = 'qlsecret:v1:forbidden';
+  const findings =
+    validatePluginPackageSecretBindingKubernetesLiveReport(invalid).findings;
+  assert.ok(findings.some((value) => value.includes('management')));
+  assert.ok(findings.some((value) => value.includes('gates')));
+  assert.ok(findings.some((value) => value.includes('forbidden')));
+});
@@ -0,0 +1,46 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const ROOT = path.resolve(__dirname, '../..');
+const CONTRACT = path.join(
+  ROOT,
+  'scripts/ql3-plugin-package-secret-binding-kubernetes-live-contract.cjs',
+);
+const BOOTSTRAP = path.join(
+  ROOT,
+  'scripts/ql3-plugin-package-secret-binding-kubernetes-live-bootstrap.cjs',
+);
+
+test('wires the Secret binding Kubernetes live gate as an explicit opt-in', () => {
+  const scripts = require(path.join(ROOT, 'package.json')).scripts;
+  assert.equal(
+    scripts['test:plugin-package-secret-binding-kubernetes-live:ql3'],
+    'pnpm --filter @qinglong/cluster-admin build && node scripts/ql3-plugin-package-secret-binding-kubernetes-live-contract.cjs',
+  );
+  assert.equal(
+    scripts['audit:plugin-package-secret-binding-kubernetes-live:ql3'],
+    'node scripts/ql3-plugin-package-secret-binding-kubernetes-live-audit.cjs',
+  );
+  const source = fs.readFileSync(CONTRACT, 'utf8');
+  assert.match(source, /QL3_PLUGIN_PACKAGE_SECRET_BINDING_KUBERNETES_LIVE/);
+  assert.match(source, /K3sDockerLiveFixture/);
+  assert.match(source, /readyManagementPods/);
+  assert.match(source, /hostAliases/);
+  assert.match(source, /pluginPackageManagementClientCli\.js/);
+  assert.match(source, /ql3-cluster-plugin-package-values/);
+  assert.match(source, /automountServiceAccountToken: false/);
+  assert.match(source, /can-i/);
+  assert.match(source, /sensitiveMatchCount/);
+});
+
+test('keeps prerequisite construction in a one-shot cluster Job', () => {
+  const source = fs.readFileSync(BOOTSTRAP, 'utf8');
+  assert.match(source, /createClusterPluginPackageManagementService/);
+  assert.match(source, /createClusterPluginPackageApprovedActionDispatcher/);
+  assert.match(source, /secretProjectionFileName/);
+  assert.doesNotMatch(source, /setInterval|setTimeout|watch\(/);
+});