open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): admit plugin secret action jobs

Browse Source
This commit is contained in:
whyour
2026-08-14 10:22:14 +08:00
parent 75dbe7a4c4
commit 7f5339e047
27 changed files with 2019 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/back/ql3ClusterDeploymentAudit.test.cjs
+50
View File
@@ -64,6 +64,56 @@ test('requires every Cluster Admin Kubernetes workload to override the image com
);
});
test('rejects widened Plugin Package Secret action Kubernetes authority', () => {
const widenedRole = auditClusterDeployment({
root: ROOT,
readFile: intercept(
'deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/role.yaml',
(source) => source.replace(' - get\n', ' - get\n - list\n'),
),
});
assert.equal(widenedRole.compatible, false);
assert.equal(
widenedRole.findings.some(
({ code }) => code === 'QL3_CLUSTER_PLUGIN_EXECUTOR_KUBERNETES_AUTHORITY',
),
true,
);
const ignoredAdmissionFailure = auditClusterDeployment({
root: ROOT,
readFile: intercept(
'deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/validating-admission-policy.yaml',
(source) => source.replace('failurePolicy: Fail', 'failurePolicy: Ignore'),
),
});
assert.equal(ignoredAdmissionFailure.compatible, false);
assert.equal(
ignoredAdmissionFailure.findings.some(
({ code }) => code === 'QL3_CLUSTER_PLUGIN_EXECUTOR_KUBERNETES_AUTHORITY',
),
true,
);
const actionToken = auditClusterDeployment({
root: ROOT,
readFile: intercept(
'deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/secret-action-service-account.yaml',
(source) => source.replace(
'automountServiceAccountToken: false',
'automountServiceAccountToken: true',
),
),
});
assert.equal(actionToken.compatible, false);
assert.equal(
actionToken.findings.some(
({ code }) => code === 'QL3_CLUSTER_PLUGIN_EXECUTOR_LIFECYCLE',
),
true,
);
});
test('requires the bounded Cluster product facade and image entrypoint', () => {
const missingBinary = auditClusterDeployment({
root: ROOT,