open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 10:32:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): separate cluster secret transition authority

Browse Source
This commit is contained in:
whyour
2026-08-13 22:56:02 +08:00
parent 5f93e0b5d2
commit d41c821ce0
34 changed files with 4157 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-postgres/src/migrations/index.ts
+2
View File
@@ -66,6 +66,7 @@ import { pg0060PluginPackageSecretMaterializationGuardMigration } from './pg-006
import { pg0061PluginPackageSecretBindingApprovalPlansMigration } from './pg-0061-plugin-package-secret-binding-approval-plans';
import { pg0062PluginPackageSecretBindingTargetGuardMigration } from './pg-0062-plugin-package-secret-binding-target-guard';
import { pg0063PluginPackageSecretBindingTransitionReceiptsMigration } from './pg-0063-plugin-package-secret-binding-transition-receipts';
import { pg0064PluginPackageSecretBindingTransitionApprovalPlansMigration } from './pg-0064-plugin-package-secret-binding-transition-approval-plans';
export const postgresqlMainMigrationStream: MigrationStreamDefinition<PostgresMigrationContext> =
Object.freeze({
@@ -137,5 +138,6 @@ export const postgresqlMainMigrationStream: MigrationStreamDefinition<PostgresMi
pg0061PluginPackageSecretBindingApprovalPlansMigration,
pg0062PluginPackageSecretBindingTargetGuardMigration,
pg0063PluginPackageSecretBindingTransitionReceiptsMigration,
pg0064PluginPackageSecretBindingTransitionApprovalPlansMigration,
]),
});
packages/ql3-cluster-postgres/src/migrations/pg-0064-plugin-package-secret-binding-transition-approval-plans.ts
+307
View File
@@ -0,0 +1,307 @@
import { CAPABILITIES_V62 } from './pg-0063-plugin-package-secret-binding-transition-receipts';
import { definePostgresSqlMigration } from './sqlMigration';
export const CAPABILITIES_V63 = CAPABILITIES_V62.replace(
'"plugin_package_secret_binding_transition_receipt":1,',
'"plugin_package_secret_binding_transition_approval_plan":1,"plugin_package_secret_binding_transition_receipt":1,',
);
export const pg0064PluginPackageSecretBindingTransitionApprovalPlansMigration =
definePostgresSqlMigration({
id: 'pg-0064-plugin-package-secret-binding-transition-approval-plans',
statements: [
`
CREATE TABLE "ql3"."plugin_package_secret_binding_transition_approval_plans" (
action_ref varchar(255) PRIMARY KEY,
approval_plan_digest char(64) NOT NULL,
transition_digest char(64) NOT NULL,
generation_digest char(64) NOT NULL,
project_id varchar(128) NOT NULL,
package_name varchar(63) NOT NULL,
installation_id varchar(128) NOT NULL,
lock_digest char(64) NOT NULL,
generation integer NOT NULL,
manifest_digest char(64) NOT NULL,
previous_active_lock_digest char(64) NOT NULL,
requested_by_type varchar(16) NOT NULL,
requested_by_id varchar(255) NOT NULL,
planned_at_ms bigint NOT NULL,
expires_at_ms bigint NOT NULL,
plan_json jsonb NOT NULL,
CONSTRAINT ql3_pp_secret_transition_plan_project_fk
FOREIGN KEY (project_id) REFERENCES "ql3"."projects" (id)
ON DELETE RESTRICT ON UPDATE RESTRICT,
CONSTRAINT ql3_pp_secret_transition_plan_install_fk
FOREIGN KEY (installation_id)
REFERENCES "ql3"."plugin_package_installs" (installation_id)
ON DELETE RESTRICT ON UPDATE RESTRICT,
CONSTRAINT ql3_pp_secret_transition_plan_identity_check CHECK (
action_ref ~ '^[A-Za-z0-9][A-Za-z0-9._:/-]{0,254}$' AND
project_id ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$' AND
package_name ~ '^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$' AND
installation_id ~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$' AND
generation BETWEEN 2 AND 2147483647 AND
requested_by_type = 'user' AND
octet_length(requested_by_id) BETWEEN 1 AND 255 AND
requested_by_id !~ '[[:cntrl:]]'
),
CONSTRAINT ql3_pp_secret_transition_plan_digest_check CHECK (
approval_plan_digest ~ '^[0-9a-f]{64}$' AND
transition_digest ~ '^[0-9a-f]{64}$' AND
generation_digest ~ '^[0-9a-f]{64}$' AND
lock_digest ~ '^[0-9a-f]{64}$' AND
manifest_digest ~ '^[0-9a-f]{64}$' AND
previous_active_lock_digest ~ '^[0-9a-f]{64}$'
),
CONSTRAINT ql3_pp_secret_transition_plan_time_check CHECK (
planned_at_ms >= 0 AND expires_at_ms > planned_at_ms AND
expires_at_ms - planned_at_ms <= 900000
),
CONSTRAINT ql3_pp_secret_transition_plan_json_check CHECK (
jsonb_typeof(plan_json) = 'object' AND
octet_length(plan_json::text) BETWEEN 2 AND 229376 AND
plan_json @> jsonb_build_object(
'schema', 'qinglong/plugin-package-secret-binding-transition-approval-plan@v1',
'actionRef', action_ref,
'approvalPlanDigest', approval_plan_digest,
'requestedBy', jsonb_build_object(
'type', requested_by_type,
'id', requested_by_id
),
'plannedAtMs', planned_at_ms,
'expiresAtMs', expires_at_ms,
'transitionPlan', jsonb_build_object(
'schema', 'qinglong/plugin-package-secret-binding-transition-plan@v1',
'transitionDigest', transition_digest,
'previousActiveLockDigest', previous_active_lock_digest,
'nextTarget', jsonb_build_object(
'generationDigest', generation_digest,
'projectId', project_id,
'packageName', package_name,
'installationId', installation_id,
'lockDigest', lock_digest,
'generation', generation,
'manifestDigest', manifest_digest
)
)
) AND
jsonb_typeof(plan_json #> '{transitionPlan,changes}') = 'array' AND
jsonb_array_length(plan_json #> '{transitionPlan,changes}') BETWEEN 1 AND 64
)
)
`.trim(),
`CREATE UNIQUE INDEX ql3_pp_secret_transition_plan_digest_uidx ON "ql3"."plugin_package_secret_binding_transition_approval_plans" (approval_plan_digest)`,
`CREATE UNIQUE INDEX ql3_pp_secret_transition_plan_target_uidx ON "ql3"."plugin_package_secret_binding_transition_approval_plans" (generation_digest)`,
`CREATE INDEX ql3_pp_secret_transition_plan_expiry_idx ON "ql3"."plugin_package_secret_binding_transition_approval_plans" (expires_at_ms, action_ref)`,
`
CREATE FUNCTION "ql3"."plugin_package_secret_binding_transition_snapshot"(
p_project_id varchar,
p_package_name varchar
)
RETURNS TABLE (
next_record_json jsonb,
next_lock_json jsonb,
next_proposal_json jsonb,
previous_record_json jsonb,
previous_lock_json jsonb,
previous_proposal_json jsonb,
previous_binding_json jsonb,
previous_attempt_generation integer,
observed_at_ms bigint
)
LANGUAGE plpgsql
VOLATILE
SECURITY DEFINER
SET search_path = pg_catalog, ql3
AS $ql3$
BEGIN
IF NOT pg_has_role(session_user, 'ql3_package_manager', 'member') THEN
RAISE EXCEPTION 'Package manager authority is required'
USING ERRCODE = 'insufficient_privilege';
END IF;
RETURN QUERY
SELECT current.record_json,
current.lock_json,
current_proposal.proposal_json,
previous.record_json,
previous.lock_json,
previous_proposal.proposal_json,
previous_binding.binding_json,
(
SELECT MAX(history.target_generation)
FROM "ql3"."plugin_package_installs" AS history
WHERE history.project_id = current.project_id
AND history.package_name = current.package_name
AND history.target_generation < current.target_generation
),
floor(extract(epoch FROM transaction_timestamp()) * 1000)::bigint
FROM "ql3"."plugin_package_install_heads" AS head
JOIN "ql3"."plugin_package_installs" AS current
ON current.installation_id = head.installation_id
AND current.project_id = head.project_id
AND current.package_name = head.package_name
JOIN "ql3"."plugin_package_admission_receipts" AS current_admission
ON current_admission.installation_id = current.installation_id
JOIN "ql3"."plugin_package_install_proposals" AS current_proposal
ON current_proposal.action_ref = current_admission.action_ref
JOIN "ql3"."plugin_package_installs" AS previous
ON previous.project_id = current.project_id
AND previous.package_name = current.package_name
AND previous.lock_digest = current.previous_active_lock_digest
JOIN "ql3"."plugin_package_admission_receipts" AS previous_admission
ON previous_admission.installation_id = previous.installation_id
JOIN "ql3"."plugin_package_install_proposals" AS previous_proposal
ON previous_proposal.action_ref = previous_admission.action_ref
LEFT JOIN "ql3"."plugin_package_secret_bindings" AS previous_binding
ON previous_binding.installation_id = previous.installation_id
AND previous_binding.project_id = previous.project_id
AND previous_binding.package_name = previous.package_name
AND previous_binding.lock_digest = previous.lock_digest
AND previous_binding.generation = previous.target_generation
WHERE head.project_id = p_project_id
AND head.package_name = p_package_name
AND current.state = 'staged'
AND current.previous_active_lock_digest IS NOT NULL
AND current.active_lock_digest = current.previous_active_lock_digest
AND current.target_generation = (
SELECT MAX(latest.target_generation)
FROM "ql3"."plugin_package_installs" AS latest
WHERE latest.project_id = current.project_id
AND latest.package_name = current.package_name
)
AND previous.state = 'active'
AND previous.active_lock_digest = previous.lock_digest
AND NOT EXISTS (
SELECT 1
FROM "ql3"."plugin_package_secret_binding_transition_receipts" receipt
WHERE receipt.project_id = current.project_id
AND receipt.package_name = current.package_name
AND receipt.generation = current.target_generation
)
FOR SHARE OF head, current, previous;
END
$ql3$
`.trim(),
`
CREATE FUNCTION "ql3"."create_plugin_package_secret_transition_plan"(
p_plan_json jsonb
)
RETURNS varchar
LANGUAGE plpgsql
VOLATILE
SECURITY DEFINER
SET search_path = pg_catalog, ql3
AS $ql3$
DECLARE
existing_plan jsonb;
inserted_action_ref varchar(255);
BEGIN
IF NOT pg_has_role(session_user, 'ql3_package_manager', 'member') THEN
RAISE EXCEPTION 'Package manager authority is required'
USING ERRCODE = 'insufficient_privilege';
END IF;
PERFORM pg_advisory_xact_lock(
hashtextextended(p_plan_json ->> 'actionRef', 70513064)
);
SELECT plan_json INTO existing_plan
FROM "ql3"."plugin_package_secret_binding_transition_approval_plans"
WHERE action_ref = p_plan_json ->> 'actionRef'
FOR SHARE;
IF existing_plan IS NOT NULL THEN
IF existing_plan = p_plan_json THEN RETURN 'existing'; END IF;
RAISE EXCEPTION 'Secret transition actionRef is already bound'
USING ERRCODE = 'unique_violation';
END IF;
INSERT INTO "ql3"."plugin_package_secret_binding_transition_approval_plans" (
action_ref, approval_plan_digest, transition_digest, generation_digest,
project_id, package_name, installation_id, lock_digest, generation,
manifest_digest, previous_active_lock_digest, requested_by_type,
requested_by_id, planned_at_ms, expires_at_ms, plan_json
)
SELECT p_plan_json ->> 'actionRef',
p_plan_json ->> 'approvalPlanDigest',
p_plan_json #>> '{transitionPlan,transitionDigest}',
p_plan_json #>> '{transitionPlan,nextTarget,generationDigest}',
p_plan_json #>> '{transitionPlan,nextTarget,projectId}',
p_plan_json #>> '{transitionPlan,nextTarget,packageName}',
p_plan_json #>> '{transitionPlan,nextTarget,installationId}',
p_plan_json #>> '{transitionPlan,nextTarget,lockDigest}',
(p_plan_json #>> '{transitionPlan,nextTarget,generation}')::integer,
p_plan_json #>> '{transitionPlan,nextTarget,manifestDigest}',
p_plan_json #>> '{transitionPlan,previousActiveLockDigest}',
p_plan_json #>> '{requestedBy,type}',
p_plan_json #>> '{requestedBy,id}',
(p_plan_json ->> 'plannedAtMs')::bigint,
(p_plan_json ->> 'expiresAtMs')::bigint,
p_plan_json
FROM "ql3"."plugin_package_install_heads" head
JOIN "ql3"."plugin_package_installs" install
ON install.installation_id = head.installation_id
AND install.project_id = head.project_id
AND install.package_name = head.package_name
JOIN "ql3"."plugin_package_installs" previous
ON previous.project_id = install.project_id
AND previous.package_name = install.package_name
AND previous.lock_digest = install.previous_active_lock_digest
LEFT JOIN "ql3"."plugin_package_secret_bindings" previous_binding
ON previous_binding.installation_id = previous.installation_id
AND previous_binding.project_id = previous.project_id
AND previous_binding.package_name = previous.package_name
AND previous_binding.lock_digest = previous.lock_digest
AND previous_binding.generation = previous.target_generation
WHERE head.project_id = p_plan_json #>> '{transitionPlan,nextTarget,projectId}'
AND head.package_name = p_plan_json #>> '{transitionPlan,nextTarget,packageName}'
AND install.installation_id = p_plan_json #>> '{transitionPlan,nextTarget,installationId}'
AND install.lock_digest = p_plan_json #>> '{transitionPlan,nextTarget,lockDigest}'
AND install.target_generation = (p_plan_json #>> '{transitionPlan,nextTarget,generation}')::integer
AND install.lock_json ->> 'manifestDigest' = p_plan_json #>> '{transitionPlan,nextTarget,manifestDigest}'
AND install.state = 'staged'
AND install.previous_active_lock_digest = p_plan_json #>> '{transitionPlan,previousActiveLockDigest}'
AND install.active_lock_digest = install.previous_active_lock_digest
AND previous.installation_id = p_plan_json #>> '{transitionPlan,previousTarget,installationId}'
AND previous.lock_digest = p_plan_json #>> '{transitionPlan,previousTarget,lockDigest}'
AND previous.target_generation = (p_plan_json #>> '{transitionPlan,previousTarget,generation}')::integer
AND previous.lock_json ->> 'manifestDigest' = p_plan_json #>> '{transitionPlan,previousTarget,manifestDigest}'
AND previous.state = 'active'
AND previous.active_lock_digest = previous.lock_digest
AND (
SELECT MAX(attempt.target_generation)
FROM "ql3"."plugin_package_installs" attempt
WHERE attempt.project_id = install.project_id
AND attempt.package_name = install.package_name
AND attempt.target_generation < install.target_generation
) = (p_plan_json #>> '{transitionPlan,previousAttemptGeneration}')::integer
AND (
(previous_binding.binding_json IS NULL AND
p_plan_json #> '{transitionPlan,previousBinding}' = 'null'::jsonb) OR
previous_binding.binding_json = p_plan_json #> '{transitionPlan,previousBinding}'
)
AND install.target_generation = (
SELECT MAX(history.target_generation)
FROM "ql3"."plugin_package_installs" history
WHERE history.project_id = install.project_id
AND history.package_name = install.package_name
)
AND NOT EXISTS (
SELECT 1 FROM "ql3"."plugin_package_secret_binding_transition_receipts" receipt
WHERE receipt.generation_digest = p_plan_json #>> '{transitionPlan,nextTarget,generationDigest}'
)
RETURNING action_ref INTO inserted_action_ref;
IF inserted_action_ref IS NULL THEN
RAISE EXCEPTION 'Secret transition target is not current staged generation'
USING ERRCODE = 'check_violation';
END IF;
RETURN 'created';
END
$ql3$
`.trim(),
`REVOKE ALL ON "ql3"."plugin_package_secret_binding_transition_approval_plans" FROM PUBLIC, ql3_runtime, ql3_admin, ql3_package_manager, ql3_package_executor, ql3_worker_ingress`,
`GRANT SELECT ON "ql3"."plugin_package_secret_binding_transition_approval_plans" TO ql3_package_manager, ql3_package_executor`,
`REVOKE ALL ON FUNCTION "ql3"."plugin_package_secret_binding_transition_snapshot"(varchar, varchar) FROM PUBLIC, ql3_runtime, ql3_admin, ql3_package_manager, ql3_package_executor, ql3_worker_ingress`,
`GRANT EXECUTE ON FUNCTION "ql3"."plugin_package_secret_binding_transition_snapshot"(varchar, varchar) TO ql3_package_manager`,
`REVOKE ALL ON FUNCTION "ql3"."create_plugin_package_secret_transition_plan"(jsonb) FROM PUBLIC, ql3_runtime, ql3_admin, ql3_package_manager, ql3_package_executor, ql3_worker_ingress`,
`GRANT EXECUTE ON FUNCTION "ql3"."create_plugin_package_secret_transition_plan"(jsonb) TO ql3_package_manager`,
`DO $ql3$ BEGIN UPDATE "ql3"."schema_capabilities" SET contract_version = 63, migration_id = 'pg-0064-plugin-package-secret-binding-transition-approval-plans', capabilities = '${CAPABILITIES_V63}'::jsonb, updated_at_ms = floor(extract(epoch FROM transaction_timestamp()) * 1000)::bigint WHERE contract_name = 'control-core' AND contract_version = 62 AND migration_id = 'pg-0063-plugin-package-secret-binding-transition-receipts' AND capabilities = '${CAPABILITIES_V62}'::jsonb; IF NOT FOUND THEN RAISE EXCEPTION 'control-core capability is not at version 62' USING ERRCODE = 'check_violation'; END IF; END $ql3$`,
],
});