open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-23 11:58:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): materialize offline deployment locks

Browse Source
This commit is contained in:
whyour
2026-08-16 13:39:50 +08:00
parent a44c213be1
commit 8c09850249
14 changed files with 1763 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/kubernetes/ql3-worker/README.md
+8 -4
View File
@@ -34,7 +34,9 @@ docker build \
Production rollout must take the Worker `@sha256:` reference from the same
verified `cluster` or `all` release set as control, control-ai and admin. A
version/source tag or a successful control image alone is not Worker release
authority. See
authority. Render the private Worker overlay, run the offline deployment-lock
post-renderer with `--required-images=worker`, audit the locked manifest, and
apply only that locked output. See
[`docs/operations/ql3-release-set-deployment.md`](../../../docs/operations/ql3-release-set-deployment.md).
The builder and runtime dependency roots have separate npm v3 locks generated
@@ -61,9 +63,11 @@ the private credential-bootstrap overlay and submit it with create-only
semantics before the first delivery:
```bash
kubectl apply -k deploy/kubernetes/ql3-worker/base
# or:
kubectl apply -k deploy/kubernetes/ql3-worker/overlays/node
kubectl kustomize deploy/kubernetes/ql3-worker/base > /private/workstation/path/worker-rendered.yaml
# or render deploy/kubernetes/ql3-worker/overlays/node
# Materialize and audit worker-locked.yaml using the release-set procedure,
# then apply only the locked output:
kubectl apply -f /private/workstation/path/worker-locked.yaml
kubectl apply -k deploy/kubernetes/ql3-worker/credential-admin
kubectl kustomize deploy/kubernetes/ql3-worker/credential-bootstrap \
| kubectl create -f -