open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 16:07:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(ql3): project cnpg runtime trust into private files

Browse Source
This commit is contained in:
whyour
2026-08-26 04:58:09 +08:00
parent eb34662d01
commit f8934b401d
3 changed files with 60 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ql3-cloudnativepg-deployment-audit.cjs
+24 -4
View File
@@ -439,8 +439,9 @@ function assertRuntimeBinding(readFile, root, findings) {
);
const env = envByName(container);
const caVolume = podSpec?.volumes?.find(
(candidate) => candidate?.name === 'postgres-runtime-ca',
(candidate) => candidate?.name === 'postgres-runtime-projected',
);
const projectedSources = caVolume?.projected?.sources;
if (
!exactFailClosedApplicationImage(kustomization) ||
env.get('QL3_POSTGRES_RUNTIME_URL')?.$patch !== 'delete' ||
@@ -458,9 +459,28 @@ function assertRuntimeBinding(readFile, root, findings) {
'password',
) ||
env.get('QL3_POSTGRES_TLS_SERVERNAME')?.value !== PRIMARY_DNS ||
caVolume?.secret?.secretName !== 'ql3-postgres-ca' ||
JSON.stringify(caVolume?.secret?.items) !==
JSON.stringify([{ key: 'ca.crt', path: 'ca.crt' }])
caVolume?.secret !== null ||
caVolume?.projected?.defaultMode !== 292 ||
JSON.stringify(projectedSources) !==
JSON.stringify([
{
secret: {
name: 'ql3-postgres-ca',
items: [{ key: 'ca.crt', path: 'ca.crt' }],
},
},
{
secret: {
name: 'ql3-cluster-control-runtime',
items: [
{
key: 'api-credential-pepper-keyring.json',
path: 'api-credential-pepper-keyring.json',
},
],
},
},
])
) {
findings.push(
finding(