feat(ql3): establish 3.0 incubation baseline

2026-09-23 12:05:27 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,196 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ql3-approval-management-client
+  namespace: qinglong3-system
+  labels:
+    app.kubernetes.io/name: ql3-approval-management-client
+    app.kubernetes.io/component: approval-management-client
+    app.kubernetes.io/part-of: qinglong3
+    qinglong.io/execution-model: caller-driven
+spec:
+  backoffLimit: 0
+  activeDeadlineSeconds: 120
+  ttlSecondsAfterFinished: 600
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: ql3-approval-management-client
+        app.kubernetes.io/component: approval-management-client
+        app.kubernetes.io/part-of: qinglong3
+        qinglong.io/execution-model: caller-driven
+        qinglong.io/approval-management-client: 'true'
+    spec:
+      serviceAccountName: ql3-approval-management-client
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: wait-for-manager
+          image: qinglong3-cluster-admin:3.0.0-alpha.0
+          imagePullPolicy: IfNotPresent
+          command:
+            - node
+            - -e
+          args:
+            - |
+              const fs = require('node:fs');
+              const https = require('node:https');
+              const host = 'ql3-approval-management.qinglong3-system.svc';
+              const ca = fs.readFileSync('/var/run/qinglong3/approval-management-trust/ca.crt');
+              const cert = fs.readFileSync('/var/run/secrets/qinglong3/approval-management-client-identity/tls.crt');
+              const key = fs.readFileSync('/var/run/secrets/qinglong3/approval-management-client-identity/tls.key');
+              const probe = () => new Promise((resolve, reject) => {
+                const request = https.request({
+                  host,
+                  port: 8447,
+                  path: '/readyz',
+                  method: 'GET',
+                  servername: host,
+                  ca,
+                  cert,
+                  key,
+                  minVersion: 'TLSv1.3',
+                  maxVersion: 'TLSv1.3',
+                  rejectUnauthorized: true,
+                  agent: false,
+                  headers: { connection: 'close' },
+                }, (response) => {
+                  response.resume();
+                  response.once('end', () =>
+                    response.statusCode === 200
+                      ? resolve()
+                      : reject(new Error('manager not ready')));
+                });
+                request.setTimeout(3000, () => request.destroy(new Error('timeout')));
+                request.once('error', reject);
+                request.end();
+              });
+              (async () => {
+                for (let attempt = 1; attempt <= 30; attempt += 1) {
+                  try {
+                    await probe();
+                    return;
+                  } catch {
+                    if (attempt === 30) throw new Error('manager readiness unavailable');
+                    await new Promise((resolve) => setTimeout(resolve, 1000));
+                  }
+                }
+              })().catch((error) => {
+                process.stderr.write(`${error.message}\n`);
+                process.exitCode = 1;
+              });
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 5m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          volumeMounts:
+            - name: trust
+              mountPath: /var/run/qinglong3/approval-management-trust
+              readOnly: true
+            - name: client-identity
+              mountPath: /var/run/secrets/qinglong3/approval-management-client-identity
+              readOnly: true
+      containers:
+        - name: client
+          image: qinglong3-cluster-admin:3.0.0-alpha.0
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -c
+          args:
+            - |
+              set -eu
+              umask 077
+              cp /var/run/secrets/qinglong3/approval-management-request/client.json /tmp/client.json
+              cp /var/run/secrets/qinglong3/approval-management-request/command.json /tmp/command.json
+              cp /var/run/secrets/qinglong3/approval-management-assertion/assertion.jwt /tmp/assertion.jwt
+              cp /var/run/qinglong3/approval-management-trust/ca.crt /tmp/ca.crt
+              cp /var/run/secrets/qinglong3/approval-management-client-identity/tls.crt /tmp/client.crt
+              cp /var/run/secrets/qinglong3/approval-management-client-identity/tls.key /tmp/client.key
+              chmod 600 /tmp/client.json /tmp/command.json /tmp/assertion.jwt /tmp/ca.crt /tmp/client.crt /tmp/client.key
+              exec node /opt/qinglong/node_modules/@qinglong/cluster-admin/dist/approval-management/approvalManagementClientCli.js \
+                --config=/tmp/client.json \
+                --command=/tmp/command.json \
+                --assertion=/tmp/assertion.jwt
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 25m
+              memory: 48Mi
+            limits:
+              cpu: 250m
+              memory: 128Mi
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: request
+              mountPath: /var/run/secrets/qinglong3/approval-management-request
+              readOnly: true
+            - name: assertion
+              mountPath: /var/run/secrets/qinglong3/approval-management-assertion
+              readOnly: true
+            - name: trust
+              mountPath: /var/run/qinglong3/approval-management-trust
+              readOnly: true
+            - name: client-identity
+              mountPath: /var/run/secrets/qinglong3/approval-management-client-identity
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 4Mi
+        - name: request
+          secret:
+            secretName: ql3-approval-management-request
+            defaultMode: 288
+            items:
+              - key: client.json
+                path: client.json
+              - key: command.json
+                path: command.json
+        - name: assertion
+          secret:
+            secretName: ql3-approval-management-assertion
+            defaultMode: 288
+            items:
+              - key: assertion.jwt
+                path: assertion.jwt
+        - name: trust
+          configMap:
+            name: ql3-approval-management-client-trust
+            defaultMode: 292
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: client-identity
+          secret:
+            secretName: ql3-approval-management-client-identity
+            defaultMode: 288
+            items:
+              - key: tls.crt
+                path: tls.crt
+              - key: tls.key
+                path: tls.key
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - service-account.yaml
+  - job.yaml
+  - network-policy.yaml
@@ -0,0 +1,39 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ql3-approval-management-client
+  namespace: qinglong3-system
+  labels:
+    app.kubernetes.io/name: ql3-approval-management-client
+    app.kubernetes.io/component: approval-management-client
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: ql3-approval-management-client
+      app.kubernetes.io/component: approval-management-client
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress: []
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: ql3-approval-management
+              app.kubernetes.io/component: approval-management
+      ports:
+        - protocol: TCP
+          port: 8447
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ql3-approval-management-client
+  namespace: qinglong3-system
+  labels:
+    app.kubernetes.io/name: ql3-approval-management-client
+    app.kubernetes.io/component: approval-management-client
+    app.kubernetes.io/part-of: qinglong3
+automountServiceAccountToken: false
@@ -0,0 +1,45 @@
+# Example only. Copy these objects into a private, per-command overlay.
+# Replace every placeholder. Never commit an assertion, private key or review detail.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-approval-management-request
+  namespace: qinglong3-system
+immutable: true
+type: Opaque
+stringData:
+  client.json: |
+    {"schemaVersion":1,"endpoint":"https://ql3-approval-management.qinglong3-system.svc:8447/api/v3/approvals/management","servername":"ql3-approval-management.qinglong3-system.svc","caFile":"/tmp/ca.crt","clientCertificateFile":"/tmp/client.crt","clientPrivateKeyFile":"/tmp/client.key","requestTimeoutMs":15000}
+  command.json: |
+    {"schemaVersion":1,"operation":"approval.inspect","request":{"projectId":"REPLACE_WITH_PROJECT_ID","approvalRequestId":"REPLACE_WITH_APPROVAL_REQUEST_ID","requestId":"REPLACE_WITH_UNIQUE_REQUEST_ID","auditEventId":"REPLACE_WITH_UUID_V4","failureAuditEventId":"REPLACE_WITH_DIFFERENT_UUID_V4"}}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ql3-approval-management-client-trust
+  namespace: qinglong3-system
+immutable: true
+data:
+  ca.crt: |
+    REPLACE_WITH_REVIEWED_MANAGER_CA_CERTIFICATE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-approval-management-assertion
+  namespace: qinglong3-system
+immutable: true
+type: Opaque
+stringData:
+  assertion.jwt: REPLACE_WITH_SHORT_LIVED_STRONG_USER_ASSERTION
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-approval-management-client-identity
+  namespace: qinglong3-system
+immutable: true
+type: kubernetes.io/tls
+stringData:
+  tls.crt: REPLACE_WITH_SHORT_LIVED_CLIENT_CERTIFICATE_CHAIN
+  tls.key: REPLACE_WITH_CLIENT_PRIVATE_KEY
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - base
+
+images:
+  - name: qinglong3-cluster-admin
+    newName: registry.example.com/qinglong/qinglong3-cluster-admin
+    # Fail closed until the independently verified release digest is supplied.
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000