open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): add opaque cluster environment bundle delivery

Browse Source
This commit is contained in:
whyour
2026-08-24 19:31:03 +08:00
parent cf2c0ec7b3
commit 4abf125ce9
36 changed files with 1682 additions and 382 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-postgres/test/definitionRepositories.test.cjs
+29
View File
@@ -17,6 +17,7 @@ const {
const {
compileClusterCommandTaskDefinition,
} = require('@qinglong/runtime-core/cluster-execution-revision');
const { createSecretRef } = require('@qinglong/runtime-core/secret-reference');
const {
TaskDefinitionAdministrationAuthorizationFenceConflictError,
TaskDefinitionAdministrationMutationConflictError,
@@ -447,6 +448,34 @@ test('publishes TaskDefinition atomically and replays the exact mutation', async
);
});
test('persists only the pinned environment bundle reference in an execution plan', async () => {
const environmentBundleRef = createSecretRef({
projectId: TASK_COMMAND.projectId,
name: 'legacy-env-bundle',
version: 7,
});
const command = {
...TASK_COMMAND,
taskId: 'task-bundle-00001',
mutationId: '123e4567-e89b-42d3-a456-426614174021',
spec: {
...TASK_COMMAND.spec,
config: { ...TASK_COMMAND.spec.config, environmentBundleRef },
},
};
const fixture = appendPool('task');
await new PostgresTaskDefinitionRepository(
fixture.pool,
).appendTaskDefinitionRevision(command);
const insert = fixture.queries.find(({ text }) =>
text.includes('INSERT INTO "ql3"."task_execution_revisions"'),
);
const plan = JSON.parse(insert.values[7]);
assert.equal(plan.environmentBundleRef, environmentBundleRef);
assert.deepEqual(plan.environment, []);
assert.equal(JSON.stringify(plan).includes('LEGACY_ENV_NAME'), false);
});
test('runs TaskDefinition transaction hooks for create and replay before COMMIT', async () => {
const createdFixture = appendPool('task');
const createdHook = [];
packages/ql3-cluster-postgres/test/remoteWorkerSecretDeliveryRepository.test.cjs
+109 -30
View File
@@ -18,12 +18,21 @@ const SOURCE_DIGEST = 'a'.repeat(64);
const TASK_REVISION = `qltd:v1:1:${SOURCE_DIGEST}`;
const LEASE_TOKEN = 'worker_generated_lease_capability_0000000000000001';
const SECRET_REF = createSecretRef({ projectId: 'project-1', name: 'token' });
const ENVIRONMENT_BUNDLE_REF = createSecretRef({
projectId: 'project-1',
name: 'legacy-env-bundle',
version: 4,
});
function revision() {
return createClusterTaskExecutionRevision({
projectId: 'project-1', taskId: 'task-1', taskRevision: TASK_REVISION,
sourceRevision: 1, sourceContentDigest: SOURCE_DIGEST,
executorType: 'remote_worker', planSchema: 'qinglong/command-execution@v1',
projectId: 'project-1',
taskId: 'task-1',
taskRevision: TASK_REVISION,
sourceRevision: 1,
sourceContentDigest: SOURCE_DIGEST,
executorType: 'remote_worker',
planSchema: 'qinglong/command-execution@v1',
command: { kind: 'argv', file: '/bin/true', args: [] },
environment: [{ name: 'TOKEN', kind: 'secret', secretRef: SECRET_REF }],
createdAtMs: 1,
@@ -32,40 +41,74 @@ function revision() {
function command(executionDigest, overrides = {}) {
return {
workerId: 'edge-1', workerSessionId: SESSION_ID, workerGeneration: 2,
runId: 'run-1', attemptId: 'attempt-1', projectId: 'project-1',
taskId: 'task-1', taskRevision: TASK_REVISION, executionDigest,
offerId: 'offer-1', leaseGeneration: 3, leaseToken: LEASE_TOKEN,
expectedLeaseVersion: 4, secretRefs: [SECRET_REF], ...overrides,
workerId: 'edge-1',
workerSessionId: SESSION_ID,
workerGeneration: 2,
runId: 'run-1',
attemptId: 'attempt-1',
projectId: 'project-1',
taskId: 'task-1',
taskRevision: TASK_REVISION,
executionDigest,
offerId: 'offer-1',
leaseGeneration: 3,
leaseToken: LEASE_TOKEN,
expectedLeaseVersion: 4,
secretRefs: [SECRET_REF],
environmentBundleRefs: [],
...overrides,
};
}
function authorityRow(plan, overrides = {}) {
return {
observedAtMs: '1000', runId: 'run-1', runProjectId: 'project-1',
runTaskId: 'task-1', runTaskRevision: TASK_REVISION,
runStatus: 'dispatching', executionOwner: 'runtime',
cancelRequestedAtMs: null, attemptStatus: 'starting',
attemptExecutorType: 'remote_worker', attemptWorkerId: 'edge-1',
attemptWorkerSessionId: SESSION_ID, attemptWorkerGeneration: 2,
observedAtMs: '1000',
runId: 'run-1',
runProjectId: 'project-1',
runTaskId: 'task-1',
runTaskRevision: TASK_REVISION,
runStatus: 'dispatching',
executionOwner: 'runtime',
cancelRequestedAtMs: null,
attemptStatus: 'starting',
attemptExecutorType: 'remote_worker',
attemptWorkerId: 'edge-1',
attemptWorkerSessionId: SESSION_ID,
attemptWorkerGeneration: 2,
attemptLeaseTokenDigest: digestRunDispatchLeaseToken(LEASE_TOKEN),
attemptLeaseGeneration: 3, attemptLeaseVersion: 4,
attemptOfferId: 'offer-1', sessionId: SESSION_ID, sessionGeneration: 2,
sessionStatus: 'online', sessionExpiresAtMs: '5000',
leaseRunId: 'run-1', leaseStatus: 'leased', leaseVersion: 4,
leaseGeneration: 3, leaseWorkerId: 'edge-1',
leaseWorkerSessionId: SESSION_ID, leaseWorkerGeneration: 2,
attemptLeaseGeneration: 3,
attemptLeaseVersion: 4,
attemptOfferId: 'offer-1',
sessionId: SESSION_ID,
sessionGeneration: 2,
sessionStatus: 'online',
sessionExpiresAtMs: '5000',
leaseRunId: 'run-1',
leaseStatus: 'leased',
leaseVersion: 4,
leaseGeneration: 3,
leaseWorkerId: 'edge-1',
leaseWorkerSessionId: SESSION_ID,
leaseWorkerGeneration: 2,
leaseTokenDigest: digestRunDispatchLeaseToken(LEASE_TOKEN),
leaseOfferId: 'offer-1', leaseExpiresAtMs: '5000',
revisionProjectId: plan.projectId, revisionTaskId: plan.taskId,
leaseOfferId: 'offer-1',
leaseExpiresAtMs: '5000',
revisionProjectId: plan.projectId,
revisionTaskId: plan.taskId,
sourceRevision: plan.sourceRevision,
revisionTaskRevision: plan.taskRevision,
sourceContentDigest: plan.sourceContentDigest,
revisionExecutorType: plan.executorType, planSchema: plan.planSchema,
revisionExecutorType: plan.executorType,
planSchema: plan.planSchema,
planJson: {
command: plan.command,
environment: plan.environment,
...(plan.workingDirectory === undefined ? {} : { workingDirectory: plan.workingDirectory }),
...(plan.environmentBundleRef === undefined
? {}
: { environmentBundleRef: plan.environmentBundleRef }),
...(plan.workingDirectory === undefined
? {}
: { workingDirectory: plan.workingDirectory }),
...(plan.timeoutMs === undefined ? {} : { timeoutMs: plan.timeoutMs }),
...(plan.placement === undefined ? {} : { placement: plan.placement }),
},
@@ -84,11 +127,15 @@ function fixture(row) {
if (sql.includes('FROM observation')) return { rows: row ? [row] : [] };
return { rows: [] };
},
release() { released += 1; },
release() {
released += 1;
},
};
return {
repository: new PostgresRemoteWorkerSecretDeliveryAuthorityRepository({
async connect() { return client; },
async connect() {
return client;
},
}),
queries,
released: () => released,
@@ -100,9 +147,13 @@ test('authorizes exact Session, Lease and immutable execution revision fences',
const { repository, queries, released } = fixture(authorityRow(plan));
const result = await repository.authorize(command(plan.contentDigest));
assert.deepEqual(result.secretRefs, [SECRET_REF]);
assert.deepEqual(result.environmentBundleRefs, []);
assert.equal(result.executionDigest, plan.contentDigest);
assert.equal('leaseToken' in result, false);
assert.equal(queries.some(({ sql }) => sql.includes('pg_advisory_xact_lock')), true);
assert.equal(
queries.some(({ sql }) => sql.includes('pg_advisory_xact_lock')),
true,
);
assert.equal(queries.at(-1).sql, 'COMMIT');
assert.equal(released(), 1);
});
@@ -129,9 +180,11 @@ test('rejects partial Secret scope and execution digest drift', async () => {
const extra = createSecretRef({ projectId: 'project-1', name: 'other' });
const partial = fixture(authorityRow(plan));
await assert.rejects(
partial.repository.authorize(command(plan.contentDigest, {
secretRefs: [extra],
})),
partial.repository.authorize(
command(plan.contentDigest, {
secretRefs: [extra],
}),
),
/secret_scope_mismatch/,
);
const digestDrift = fixture(authorityRow(plan));
@@ -140,3 +193,29 @@ test('rejects partial Secret scope and execution digest drift', async () => {
/secret_scope_mismatch/,
);
});
test('authorizes a bundle-only execution without exposing environment names', async () => {
const plan = createClusterTaskExecutionRevision({
projectId: 'project-1',
taskId: 'task-1',
taskRevision: TASK_REVISION,
sourceRevision: 1,
sourceContentDigest: SOURCE_DIGEST,
executorType: 'remote_worker',
planSchema: 'qinglong/command-execution@v1',
command: { kind: 'argv', file: '/bin/true', args: [] },
environment: [],
environmentBundleRef: ENVIRONMENT_BUNDLE_REF,
createdAtMs: 1,
});
const { repository } = fixture(authorityRow(plan));
const result = await repository.authorize(
command(plan.contentDigest, {
secretRefs: [],
environmentBundleRefs: [ENVIRONMENT_BUNDLE_REF],
}),
);
assert.deepEqual(result.secretRefs, []);
assert.deepEqual(result.environmentBundleRefs, [ENVIRONMENT_BUNDLE_REF]);
assert.equal(JSON.stringify(result).includes('LEGACY_VALUE'), false);
});