open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-23 03:18:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): validate cluster credential key rotation

Browse Source
This commit is contained in:
whyour
2026-08-26 03:31:13 +08:00
parent b45a5e04b7
commit ac0992081e
23 changed files with 1119 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ql3-cluster-deployment-audit.cjs
+12 -2
View File
@@ -796,6 +796,10 @@ function assertKubernetes(readFile, root, findings) {
'QL3_POSTGRES_TLS_CA_FILE',
'/var/run/secrets/qinglong3/postgres-runtime/ca.crt',
],
[
'QL3_API_CREDENTIAL_PEPPER_KEYRING_FILE',
'/var/run/secrets/qinglong3/postgres-runtime/api-credential-pepper-keyring.json',
],
['QL3_WORKER_INGRESS_ENABLED', 'true'],
['QL3_WORKER_INGRESS_HOST', '0.0.0.0'],
['QL3_WORKER_INGRESS_PORT', '5801'],
@@ -854,7 +858,14 @@ function assertKubernetes(readFile, root, findings) {
runtimeCaVolume?.secret?.secretName !== 'ql3-cluster-control-runtime' ||
runtimeCaVolume?.secret?.defaultMode !== 0o444 ||
JSON.stringify(runtimeCaVolume?.secret?.items) !==
JSON.stringify([{ key: 'postgres-ca.crt', path: 'ca.crt' }])
JSON.stringify([
{ key: 'postgres-ca.crt', path: 'ca.crt' },
{
key: 'api-credential-pepper-keyring.json',
path: 'api-credential-pepper-keyring.json',
},
]) ||
env.has('QL3_API_CREDENTIAL_PEPPER')
) {
findings.push(
finding(
@@ -866,7 +877,6 @@ function assertKubernetes(readFile, root, findings) {
for (const [name, key] of [
['QL3_POSTGRES_RUNTIME_URL', 'postgres-runtime-url'],
['QL3_POSTGRES_TLS_SERVERNAME', 'postgres-tls-servername'],
['QL3_API_CREDENTIAL_PEPPER', 'api-credential-pepper'],
]) {
const secret = env.get(name)?.valueFrom?.secretKeyRef;
if (secret?.name !== 'ql3-cluster-control-runtime' || secret?.key !== key) {