open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-21 09:58:46 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): separate cluster secret transition authority

Browse Source
This commit is contained in:
whyour
2026-08-13 22:56:02 +08:00
parent 5f93e0b5d2
commit d41c821ce0
34 changed files with 4157 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-admin/src/plugin-package/executor/pluginPackageApprovedAction.ts
+8
View File
@@ -10,6 +10,8 @@ import { PostgresPluginPackageInstallRepository } from '@qinglong/cluster-postgr
import {
PostgresPluginPackageSecretBindingApprovalPlanReader,
PostgresPluginPackageSecretBindingRepository,
PostgresPluginPackageSecretBindingTransitionApprovalPlanReader,
PostgresPluginPackageSecretBindingTransitionRepository,
} from '@qinglong/cluster-postgres/package-executor';
import { PostgresPluginPackageInstallProposalRepository } from '@qinglong/cluster-postgres/plugin-package-proposal';
import {
@@ -27,6 +29,7 @@ import {
type ClusterPluginPackagePublisherTrustTransitionExecutionPort,
} from '../publisher/pluginPackagePublisherTrustTransitionApprovedAction';
import { ClusterPluginPackageSecretBindingApprovedActionHandler } from '../secret-binding/pluginPackageSecretBindingApprovedAction';
import { ClusterPluginPackageSecretBindingTransitionApprovedActionHandler } from '../secret-binding/pluginPackageSecretBindingTransitionApprovedAction';
import type { PluginPackageSecretExistenceInspector } from '../secret-binding/projectedSecretExistenceInspector';
export const CLUSTER_PLUGIN_PACKAGE_DISPATCH_BATCH_LIMIT = 16;
@@ -66,6 +69,11 @@ export function createClusterPluginPackageApprovedActionDispatcher(
new PostgresPluginPackageSecretBindingRepository(pool),
secretExistenceInspector,
),
new ClusterPluginPackageSecretBindingTransitionApprovedActionHandler(
new PostgresPluginPackageSecretBindingTransitionApprovalPlanReader(pool),
new PostgresPluginPackageSecretBindingTransitionRepository(pool),
secretExistenceInspector,
),
...(['overlap_add', 'safe_retire'] as const).map(
(mode) =>
new ClusterPluginPackagePublisherTrustTransitionApprovedActionHandler(
packages/ql3-cluster-admin/src/plugin-package/executor/pluginPackageExecutorProcess.ts
+24
View File
@@ -39,6 +39,11 @@ import {
type ClusterPluginPackageSecretBindingApprovalSummary,
type ConsumeClusterPluginPackageSecretBindingApprovalsOptions,
} from '../secret-binding/pluginPackageSecretBindingApprovalConsumer';
import {
consumeClusterPluginPackageSecretBindingTransitionApprovals,
type ClusterPluginPackageSecretBindingTransitionApprovalSummary,
type ConsumeClusterPluginPackageSecretBindingTransitionApprovalsOptions,
} from '../secret-binding/pluginPackageSecretBindingTransitionApprovalConsumer';
import { ProjectedPluginPackageSecretExistenceInspector } from '../secret-binding/projectedSecretExistenceInspector';
import {
runClusterPluginPackagePublisherRevocation,
@@ -70,6 +75,7 @@ export interface ClusterPluginPackageExecutorBatchResult {
readonly approvals: Readonly<ClusterPluginPackagePublisherRevocationApprovalSummary>;
readonly trustTransitionApprovals: Readonly<ClusterPluginPackagePublisherTrustTransitionApprovalSummary>;
readonly secretBindingApprovals: Readonly<ClusterPluginPackageSecretBindingApprovalSummary>;
readonly secretBindingTransitionApprovals: Readonly<ClusterPluginPackageSecretBindingTransitionApprovalSummary>;
readonly dispatch: Readonly<ApprovedActionDispatchBatchSummary>;
}
@@ -97,6 +103,11 @@ export interface RunClusterPluginPackageExecutorProcessOptions {
readonly consumeSecretBindingApprovals?: (
options: ConsumeClusterPluginPackageSecretBindingApprovalsOptions,
) => Promise<Readonly<ClusterPluginPackageSecretBindingApprovalSummary>>;
readonly consumeSecretBindingTransitionApprovals?: (
options: ConsumeClusterPluginPackageSecretBindingTransitionApprovalsOptions,
) => Promise<
Readonly<ClusterPluginPackageSecretBindingTransitionApprovalSummary>
>;
readonly createDispatcher?: (
options: ClusterPluginPackageApprovedActionDispatcherOptions,
) => ApprovedActionDispatcher;
@@ -375,6 +386,7 @@ function isIdleBatch(
batch.approvals.scanned === 0 &&
batch.trustTransitionApprovals.scanned === 0 &&
batch.secretBindingApprovals.scanned === 0 &&
batch.secretBindingTransitionApprovals.scanned === 0 &&
batch.dispatch.scanned === 0
);
}
@@ -395,6 +407,8 @@ export async function runClusterPluginPackageExecutorProcess(
typeof options.consumeTrustTransitionApprovals !== 'function') ||
(options.consumeSecretBindingApprovals !== undefined &&
typeof options.consumeSecretBindingApprovals !== 'function') ||
(options.consumeSecretBindingTransitionApprovals !== undefined &&
typeof options.consumeSecretBindingTransitionApprovals !== 'function') ||
(options.createDispatcher !== undefined &&
typeof options.createDispatcher !== 'function') ||
(options.now !== undefined && typeof options.now !== 'function')
@@ -431,6 +445,9 @@ export async function runClusterPluginPackageExecutorProcess(
const consumeSecretBindingApprovals =
options.consumeSecretBindingApprovals ??
consumeClusterPluginPackageSecretBindingApprovals;
const consumeSecretBindingTransitionApprovals =
options.consumeSecretBindingTransitionApprovals ??
consumeClusterPluginPackageSecretBindingTransitionApprovals;
const dispatcher = dispatcherFactory({
pool: database.pool,
owner: config.owner,
@@ -487,6 +504,12 @@ export async function runClusterPluginPackageExecutorProcess(
limit: config.approvalBatchSize,
...(options.now ? { now: options.now } : {}),
});
const secretBindingTransitionApprovals =
await consumeSecretBindingTransitionApprovals({
pool: database.pool,
limit: config.approvalBatchSize,
...(options.now ? { now: options.now } : {}),
});
const dispatch = await dispatcher.dispatchBatch({
limit: config.dispatchBatchSize,
});
@@ -494,6 +517,7 @@ export async function runClusterPluginPackageExecutorProcess(
approvals,
trustTransitionApprovals,
secretBindingApprovals,
secretBindingTransitionApprovals,
dispatch,
});
batches.push(batch);