feat(ql3): establish 3.0 incubation baseline

2026-09-22 02:27:44 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,181 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+
+const {
+  FIXTURE,
+  LIMITATIONS,
+  validateProviderCredentialTestKubernetesLiveReport,
+} = require('../../scripts/ql3-provider-credential-test-kubernetes-live-audit.cjs');
+
+const sha = (value) => `sha256:${value.repeat(64)}`;
+
+function report() {
+  return {
+    schemaVersion: 1,
+    fixture: FIXTURE,
+    observedAt: '2026-08-03T12:00:00.000Z',
+    platform: {
+      distribution: 'k3s',
+      kubernetesVersion: 'v1.34.3+k3s1',
+      architecture: 'arm64',
+      kubernetesImageId: sha('1'),
+      adminImageId: sha('2'),
+      cniName: 'flannel',
+      cniDistributionBinding: 'rancher/k3s:v1.34.3-k3s1',
+      controlPlaneNodes: 1,
+      workerNodes: 2,
+      cniReadyNodes: 3,
+    },
+    database: {
+      operator: 'cloudnative-pg',
+      operatorVersion: '1.30.0',
+      postgresVersionNumber: 180004,
+      postgresImageId: sha('3'),
+      instances: 3,
+      readyInstances: 3,
+      managerRole: 'ql3_ai_credential_manager',
+      testerRole: 'ql3_ai_credential_tester',
+      migrationCount: 54,
+      aiMigrationCount: 15,
+      tlsVerified: true,
+      primaryChangedDuringFailover: true,
+    },
+    provider: {
+      protocol: 'HTTPS',
+      service: 'ql3-provider-live',
+      port: 8443,
+      replicas: 1,
+      initialPodIdentitySha256: sha('4'),
+      rotatedPodIdentitySha256: sha('5'),
+      caSha256: sha('6'),
+      modelCount: 2,
+      requestCount: 5,
+      materialGenerationCount: 2,
+      exactPrivateCidrPolicy: true,
+    },
+    executor: {
+      binary: 'ql3-provider-credential-test-execute',
+      callerDrivenJobs: true,
+      jobsRun: 8,
+      backoffLimit: 0,
+      activeDeadlineSeconds: 60,
+      ttlSecondsAfterFinished: 300,
+      serviceAccount: 'ql3-provider-credential-test-executor',
+      serviceAccountTokenMounted: false,
+      rbacGranted: false,
+      poolMaxConnections: 1,
+      responseRedacted: true,
+      outcomes: {
+        baseDenied: 'unreachable',
+        exactAllowed: 'reachable',
+        exactReplay: 'reachable',
+        postFailover: 'reachable',
+        refreshedCidr: 'reachable',
+        rotatedMaterial: 'reachable',
+        staleCidr: 'unreachable',
+        staleMaterial: 'unreachable',
+      },
+    },
+    rotation: {
+      newPodObservedNewProjection: true,
+      oldMaterialRejectedAfterRotation: true,
+      projectedMaterialReresolved: true,
+      providerPodReplaced: true,
+      staleCidrFailedClosed: true,
+    },
+    isolation: {
+      baseProviderEgressDenied: true,
+      cloudNativePgEgressAllowed: true,
+      exactProviderEgressAllowed: true,
+      kubernetesApiEgressDenied: true,
+      managerMountedNoProviderMaterial: true,
+      publicInternetEgressDenied: true,
+      staleProviderCidrDenied: true,
+      testerMutationRbacDenied: true,
+    },
+    durability: {
+      planCount: 7,
+      executionCount: 7,
+      resultCount: 7,
+      credentialUseAuditCount: 5,
+      planAuditCount: 7,
+      reachableCount: 4,
+      unreachableCount: 3,
+      providerRequestCount: 5,
+      replayDuplicateCount: 0,
+      survivedCloudNativePgFailover: true,
+    },
+    gates: {
+      contentFreeEvidence: true,
+      durableFactsSurvivedFailover: true,
+      exactPrivateProviderEgress: true,
+      leastPrivilege: true,
+      passed: true,
+      projectedMaterialRotation: true,
+      realCniPolicy: true,
+      realThreeNodeKubernetes: true,
+      eightOneShotJobs: true,
+      threeInstanceCloudNativePg: true,
+    },
+    limitations: [...LIMITATIONS],
+  };
+}
+
+test('accepts the exact content-free credential test Kubernetes report', () => {
+  const result = validateProviderCredentialTestKubernetesLiveReport(report());
+  assert.deepEqual(result.findings, []);
+  assert.equal(result.compatible, true);
+});
+
+test('rejects widened, false and sensitive reports', () => {
+  const widened = report();
+  widened.extra = true;
+  assert.ok(
+    validateProviderCredentialTestKubernetesLiveReport(widened).findings.some(
+      ({ code }) =>
+        code === 'QL3_PROVIDER_CREDENTIAL_TEST_KUBERNETES_LIVE_REPORT_SHAPE',
+    ),
+  );
+
+  const falseGate = report();
+  falseGate.gates.passed = false;
+  assert.ok(
+    validateProviderCredentialTestKubernetesLiveReport(falseGate).findings.some(
+      ({ code }) =>
+        code === 'QL3_PROVIDER_CREDENTIAL_TEST_KUBERNETES_LIVE_GATES',
+    ),
+  );
+
+  const sensitive = report();
+  sensitive.executor.token = 'provider-value';
+  assert.ok(
+    validateProviderCredentialTestKubernetesLiveReport(sensitive).findings.some(
+      ({ code }) =>
+        code === 'QL3_PROVIDER_CREDENTIAL_TEST_KUBERNETES_LIVE_SENSITIVE',
+    ),
+  );
+});
+
+test('rejects incomplete network, rotation and durability evidence', () => {
+  const value = report();
+  value.isolation.staleProviderCidrDenied = false;
+  value.rotation.projectedMaterialReresolved = false;
+  value.durability.providerRequestCount = 4;
+  const codes = new Set(
+    validateProviderCredentialTestKubernetesLiveReport(value).findings.map(
+      ({ code }) => code,
+    ),
+  );
+  assert.equal(
+    codes.has('QL3_PROVIDER_CREDENTIAL_TEST_KUBERNETES_LIVE_ISOLATION'),
+    true,
+  );
+  assert.equal(
+    codes.has('QL3_PROVIDER_CREDENTIAL_TEST_KUBERNETES_LIVE_ROTATION'),
+    true,
+  );
+  assert.equal(
+    codes.has('QL3_PROVIDER_CREDENTIAL_TEST_KUBERNETES_LIVE_DURABILITY'),
+    true,
+  );
+});