feat(ql3): add direct Vault KV worker secret custody

2026-09-22 19:29:13 +08:00 · 2026-08-25 00:16:59 +08:00
parent a64d08bda1
commit 686873f8ec
25 changed files with 2830 additions and 37 deletions
@@ -0,0 +1,47 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const {
+  auditVaultKvWorkerSecretDeployment,
+} = require('../../scripts/ql3-vault-kv-worker-secret-deployment-audit.cjs');
+
+const ROOT = path.resolve(__dirname, '../..');
+
+test('accepts the exact direct Vault KV deployment overlay', () => {
+  assert.deepEqual(auditVaultKvWorkerSecretDeployment({ root: ROOT }), {
+    schemaVersion: 1,
+    provider: 'vault-kv-v2',
+    mountedValueProjection: false,
+    findings: [],
+    compatible: true,
+  });
+});
+
+test('rejects a restored mounted-value projection or broad token TTL', () => {
+  const readFile = (file, encoding) => {
+    const source = fs.readFileSync(file, encoding);
+    if (!file.endsWith('deployment-patch.yaml')) return source;
+    return source
+      .replace(
+        "QL3_WORKER_SECRET_VAULT_MAX_TOKEN_TTL_SECONDS\n              value: '900'",
+        "QL3_WORKER_SECRET_VAULT_MAX_TOKEN_TTL_SECONDS\n              value: '3600'",
+      )
+      .replace(
+        '- name: worker-secret-values\n              $patch: delete',
+        '- name: worker-secret-values\n              mountPath: /run/values',
+      );
+  };
+  const result = auditVaultKvWorkerSecretDeployment({ root: ROOT, readFile });
+  assert.equal(result.compatible, false);
+  assert.deepEqual(
+    result.findings.map(({ code }) => code),
+    [
+      'QL3_VAULT_KV_WORKER_SECRET_ENVIRONMENT_INVALID',
+      'QL3_VAULT_KV_WORKER_SECRET_PROJECTION_INVALID',
+    ],
+  );
+});