open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-23 20:15:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): add opaque cluster environment bundle delivery

Browse Source
This commit is contained in:
whyour
2026-08-24 19:31:03 +08:00
parent cf2c0ec7b3
commit 4abf125ce9
36 changed files with 1682 additions and 382 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-control/test/workerIngressPipeline.test.cjs
+10 -4
View File
@@ -592,6 +592,7 @@ test('binds one Secret batch to path identity and never echoes capabilities', as
offerId: command.offerId,
executionDigest: command.executionDigest,
values: [{ secretRef, value: 'resolved-value' }],
environmentBundles: [],
dispose() { disposed += 1; },
};
},
@@ -599,18 +600,20 @@ test('binds one Secret batch to path identity and never echoes capabilities', as
});
const leaseToken = 'worker_generated_lease_capability_0000000000000001';
const body = {
schema: 'qinglong/remote-secret-delivery@v1',
schema: 'qinglong/remote-secret-delivery@v2',
runId: 'run-1', attemptId: 'attempt-1', projectId: 'project-1',
taskId: 'task-1', taskRevision: 'revision-1', executionDigest,
workerGeneration: 2, offerId: 'offer-1', leaseGeneration: 3,
leaseToken, expectedLeaseVersion: 4, secretRefs: [secretRef],
environmentBundleRefs: [],
};
const result = await (await pipeline.prepare(metadata('secrets'))).handle(body);
assert.equal(result.statusCode, 200);
assert.equal(result.body.schema, 'qinglong/remote-secret-delivery@v1');
assert.equal(result.body.schema, 'qinglong/remote-secret-delivery@v2');
assert.deepEqual(result.body.values, [
{ secretRef, value: 'resolved-value' },
]);
assert.deepEqual(result.body.environmentBundles, []);
assert.equal(JSON.stringify(result.body).includes(leaseToken), false);
const { schema: _schema, ...commandBody } = body;
assert.deepEqual(observed, {
@@ -634,13 +637,14 @@ test('maps stale Secret delivery authority to conflict before any response', asy
});
await assert.rejects(
(await pipeline.prepare(metadata('secrets'))).handle({
schema: 'qinglong/remote-secret-delivery@v1',
schema: 'qinglong/remote-secret-delivery@v2',
runId: 'run-1', attemptId: 'attempt-1', projectId: 'project-1',
taskId: 'task-1', taskRevision: 'revision-1',
executionDigest: 'c'.repeat(64), workerGeneration: 2,
offerId: 'offer-1', leaseGeneration: 3,
leaseToken: 'worker_generated_lease_capability_0000000000000001',
expectedLeaseVersion: 4, secretRefs: [secretRef],
environmentBundleRefs: [],
}),
(error) =>
error.statusCode === 409 && error.code === 'worker_secret_delivery_fenced',
@@ -656,19 +660,21 @@ test('rejects a Secret service response whose authority drifts', async () => {
runId: 'run-other', attemptId: 'attempt-1', offerId: 'offer-1',
executionDigest: 'c'.repeat(64),
values: [{ secretRef, value: 'must-not-escape' }],
environmentBundles: [],
};
},
},
});
await assert.rejects(
(await pipeline.prepare(metadata('secrets'))).handle({
schema: 'qinglong/remote-secret-delivery@v1',
schema: 'qinglong/remote-secret-delivery@v2',
runId: 'run-1', attemptId: 'attempt-1', projectId: 'project-1',
taskId: 'task-1', taskRevision: 'revision-1',
executionDigest: 'c'.repeat(64), workerGeneration: 2,
offerId: 'offer-1', leaseGeneration: 3,
leaseToken: 'worker_generated_lease_capability_0000000000000001',
expectedLeaseVersion: 4, secretRefs: [secretRef],
environmentBundleRefs: [],
}),
(error) =>
error.statusCode === 503 && error.code === 'worker_ingress_unavailable',