open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 02:27:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): observe package installations in console

Browse Source
This commit is contained in:
whyour
2026-08-20 14:42:54 +08:00
parent 344680d64a
commit ffa4b4e7cb
29 changed files with 1259 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ql3-cluster-copilot-console-distribution-audit.cjs
+18
View File
@@ -15,6 +15,8 @@ const FILES = Object.freeze({
'deploy/console/ql3-cluster-copilot/run-management-client-config.example.json',
workerManagementExample:
'deploy/console/ql3-cluster-copilot/worker-management-client-config.example.json',
packageManagementExample:
'deploy/console/ql3-cluster-copilot/package-management-client-config.example.json',
image: 'deploy/containers/ql3-cluster-admin/Dockerfile',
workflow: '.github/workflows/ql3-image-release.yml',
candidate: 'scripts/ql3-release-candidate-contract.cjs',
@@ -92,6 +94,9 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
'QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT-disabled',
'--worker-management-config /var/run/secrets/qinglong3/copilot-console/worker-management-client.json',
'--worker-management-assertion /var/run/secrets/qinglong3/copilot-console/worker-management-assertion.jwt',
'QL3_COPILOT_CONSOLE_PACKAGE_MANAGEMENT-disabled',
'--package-management-config /var/run/secrets/qinglong3/copilot-console/package-management-client.json',
'--package-management-assertion /var/run/secrets/qinglong3/copilot-console/package-management-assertion.jwt',
],
'QL3_COPILOT_CONSOLE_LAUNCHER_CONTRACT_DRIFT',
);
@@ -105,6 +110,15 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
],
'QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT_EXAMPLE_DRIFT',
);
requireFragments(
'packageManagementExample',
[
'"schemaVersion": 1',
'/api/v3/plugin-packages/management',
'package-management-ca.pem',
],
'QL3_COPILOT_CONSOLE_PACKAGE_MANAGEMENT_EXAMPLE_DRIFT',
);
rejectFragments(
'launcher',
['--privileged', '--network host', '/var/run/docker.sock', '--pull always'],
@@ -222,6 +236,7 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
QL3_COPILOT_CONSOLE_RESOURCE_CLASS: 'compact',
QL3_COPILOT_CONSOLE_RUN_MANAGEMENT: 'disabled',
QL3_COPILOT_CONSOLE_WORKER_MANAGEMENT: 'disabled',
QL3_COPILOT_CONSOLE_PACKAGE_MANAGEMENT: 'disabled',
};
if (
environment &&
@@ -249,6 +264,8 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
'share/ql3-copilot-console/run-management-client-config.example.json',
'COPY --chmod=0444 deploy/console/ql3-cluster-copilot/worker-management-client-config.example.json',
'share/ql3-copilot-console/worker-management-client-config.example.json',
'COPY --chmod=0444 deploy/console/ql3-cluster-copilot/package-management-client-config.example.json',
'share/ql3-copilot-console/package-management-client-config.example.json',
],
'QL3_COPILOT_CONSOLE_IMAGE_DISTRIBUTION_DRIFT',
);
@@ -343,6 +360,7 @@ function auditClusterCopilotConsoleDistribution(options = {}) {
additionalWorkspacePackages: 0,
runManagementAuthorityDefault: 'disabled',
workerManagementAuthorityDefault: 'disabled',
packageManagementAuthorityDefault: 'disabled',
externalWorkstationCeremony: 'source-tag-private-report',
ceremonyStatus: 'implementation-ready-public-release-pending',
findings: Object.freeze(findings),