open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-21 01:32:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(ql3): preserve materialization in live fixtures

Browse Source
This commit is contained in:
whyour
2026-08-26 04:32:53 +08:00
parent beb490c48c
commit eb34662d01
4 changed files with 175 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ql3-cloudnativepg-live-contract.cjs
+11 -4
View File
@@ -442,13 +442,19 @@ function imageTag(reference) {
return tag;
}
function localApplicationManifest(rendered) {
function localApplicationManifest(rendered, expectedPlaceholderCount = 1) {
assert.ok(
Number.isInteger(expectedPlaceholderCount) &&
expectedPlaceholderCount >= 1 &&
expectedPlaceholderCount <= 2,
'expected application image placeholder count must be one or two',
);
assert.equal(
rendered.split(APP_IMAGE_PLACEHOLDER).length - 1,
1,
'rendered application manifest must contain exactly one fail-closed image placeholder',
expectedPlaceholderCount,
`rendered application manifest must contain exactly ${expectedPlaceholderCount} fail-closed image placeholder(s)`,
);
const local = rendered.replace(APP_IMAGE_PLACEHOLDER, APP_IMAGE);
const local = rendered.replaceAll(APP_IMAGE_PLACEHOLDER, APP_IMAGE);
assert.ok(
!local.includes(`@sha256:${'0'.repeat(64)}`),
'rendered application manifest retained a fail-closed image placeholder',
@@ -859,6 +865,7 @@ async function main() {
['kustomize', 'deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg'],
{ capture: true, quiet: true },
),
2,
);
kubectl(['apply', '-f', '-'], { input: runtimeManifest });
kubectl([
scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs
+119 -77
View File
@@ -1450,6 +1450,122 @@ function recoveryRbacEvidence() {
return Object.freeze(decisions);
}
function runtimeKeyringMaterializationSource() {
return [
"const fs=require('node:fs')",
"const path=require('node:path')",
"const source=fs.realpathSync('/var/run/secrets/qinglong3/api-credential-projected/..data')",
"const output='/var/run/secrets/qinglong3/runtime/keyring.json'",
"fs.copyFileSync(path.join(source,'keyring.json'),output,fs.constants.COPYFILE_EXCL)",
'fs.chmodSync(output,0o400)',
].join(';');
}
function runtimeDeploymentResources(annotation) {
const names = [
'service-account.yaml',
'service.yaml',
'pod-disruption-budget.yaml',
'deployment.yaml',
];
const resources = names.flatMap((name) =>
readYamlDocuments(
path.join(ROOT, 'deploy/kubernetes/ql3-cluster/base', name),
),
);
for (const resource of resources) {
resource.metadata.namespace = NAMESPACE;
if (resource.kind !== 'Deployment') continue;
resource.metadata.annotations = annotation;
const pod = resource.spec.template.spec;
const container = pod.containers[0];
const materializer = pod.initContainers[0];
container.image = CONTROL_IMAGE;
container.imagePullPolicy = 'Never';
materializer.image = CONTROL_IMAGE;
materializer.imagePullPolicy = 'Never';
materializer.command = [
'node',
'-e',
runtimeKeyringMaterializationSource(),
];
materializer.volumeMounts = [
{
name: 'api-credential-keyring-projected',
mountPath: '/var/run/secrets/qinglong3/api-credential-projected',
readOnly: true,
},
{
name: 'runtime-private',
mountPath: '/var/run/secrets/qinglong3/runtime',
},
];
container.env = [
{ name: 'QL_DEPLOYMENT_PROFILE', value: 'cluster-control' },
{ name: 'QL3_CLUSTER_CONTROL_ENABLED', value: 'true' },
{ name: 'QL3_CLUSTER_HTTP_HOST', value: '0.0.0.0' },
{ name: 'QL3_CLUSTER_HTTP_PORT', value: '5800' },
{ name: 'QL3_CLUSTER_HTTP_DRAIN_TIMEOUT_MS', value: '10000' },
{ name: 'QL3_POSTGRES_TLS_MODE', value: 'disable' },
{ name: 'QL3_POSTGRES_ALLOW_INSECURE', value: 'true' },
{ name: 'QL3_POSTGRES_MAX_CONNECTIONS', value: '4' },
{
name: 'QL3_POSTGRES_APPLICATION_NAME',
value: 'qinglong3-plugin-recovery-e2e-runtime',
},
{
name: 'QL3_CLUSTER_REPLICA_ID',
valueFrom: {
fieldRef: { apiVersion: 'v1', fieldPath: 'metadata.name' },
},
},
{
name: 'QL3_POSTGRES_RUNTIME_URL',
valueFrom: {
secretKeyRef: {
name: 'ql3-cluster-control-runtime',
key: 'postgres-runtime-url',
},
},
},
{
name: 'QL3_API_CREDENTIAL_PEPPER_KEYRING_FILE',
value: '/var/run/secrets/qinglong3/runtime/keyring.json',
},
];
container.volumeMounts = [
{ name: 'tmp', mountPath: '/tmp' },
{
name: 'runtime-private',
mountPath: '/var/run/secrets/qinglong3/runtime',
readOnly: true,
},
];
pod.volumes = [
{
name: 'tmp',
emptyDir: { medium: 'Memory', sizeLimit: '16Mi' },
},
{
name: 'api-credential-keyring-projected',
secret: {
secretName: 'ql3-cluster-control-runtime',
defaultMode: 288,
items: [{
key: 'api-credential-pepper-keyring.json',
path: 'keyring.json',
}],
},
},
{
name: 'runtime-private',
emptyDir: { medium: 'Memory', sizeLimit: '1Mi' },
},
];
}
return resources;
}
function applyRuntimeAfterRecovery(recoveryJob, migrationJobValue, secrets) {
const recoveryComplete = recoveryJob.status.conditions.find(
(condition) => condition.type === 'Complete' && condition.status === 'True',
@@ -1495,83 +1611,7 @@ function applyRuntimeAfterRecovery(recoveryJob, migrationJobValue, secrets) {
},
'create runtime-only credential after recovery success',
);
const names = [
'service-account.yaml',
'service.yaml',
'pod-disruption-budget.yaml',
'deployment.yaml',
];
const resources = names.flatMap((name) =>
readYamlDocuments(
path.join(ROOT, 'deploy/kubernetes/ql3-cluster/base', name),
),
);
for (const resource of resources) {
resource.metadata.namespace = NAMESPACE;
if (resource.kind !== 'Deployment') continue;
resource.metadata.annotations = annotation;
const container = resource.spec.template.spec.containers[0];
container.image = CONTROL_IMAGE;
container.imagePullPolicy = 'Never';
container.env = [
{ name: 'QL_DEPLOYMENT_PROFILE', value: 'cluster-control' },
{ name: 'QL3_CLUSTER_CONTROL_ENABLED', value: 'true' },
{ name: 'QL3_CLUSTER_HTTP_HOST', value: '0.0.0.0' },
{ name: 'QL3_CLUSTER_HTTP_PORT', value: '5800' },
{ name: 'QL3_CLUSTER_HTTP_DRAIN_TIMEOUT_MS', value: '10000' },
{ name: 'QL3_POSTGRES_TLS_MODE', value: 'disable' },
{ name: 'QL3_POSTGRES_ALLOW_INSECURE', value: 'true' },
{ name: 'QL3_POSTGRES_MAX_CONNECTIONS', value: '4' },
{
name: 'QL3_POSTGRES_APPLICATION_NAME',
value: 'qinglong3-plugin-recovery-e2e-runtime',
},
{
name: 'QL3_CLUSTER_REPLICA_ID',
valueFrom: {
fieldRef: { apiVersion: 'v1', fieldPath: 'metadata.name' },
},
},
{
name: 'QL3_POSTGRES_RUNTIME_URL',
valueFrom: {
secretKeyRef: {
name: 'ql3-cluster-control-runtime',
key: 'postgres-runtime-url',
},
},
},
{
name: 'QL3_API_CREDENTIAL_PEPPER_KEYRING_FILE',
value: '/var/run/secrets/qinglong3/api-credential/keyring.json',
},
];
container.volumeMounts = [
{ name: 'tmp', mountPath: '/tmp' },
{
name: 'api-credential-keyring',
mountPath: '/var/run/secrets/qinglong3/api-credential',
readOnly: true,
},
];
resource.spec.template.spec.volumes = [
{
name: 'tmp',
emptyDir: { medium: 'Memory', sizeLimit: '16Mi' },
},
{
name: 'api-credential-keyring',
secret: {
secretName: 'ql3-cluster-control-runtime',
defaultMode: 288,
items: [{
key: 'api-credential-pepper-keyring.json',
path: 'keyring.json',
}],
},
},
];
}
const resources = runtimeDeploymentResources(annotation);
for (const resource of resources) {
apply(resource, `deployment controller apply ${resource.kind}`);
}
@@ -2060,5 +2100,7 @@ module.exports = {
REPORT_SCHEMA,
buildOrderingEvidence,
privateReportPath,
runtimeDeploymentResources,
runtimeKeyringMaterializationSource,
writePrivateReport,
};