mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-21 01:32:44 +08:00
86 lines
3.9 KiB
JavaScript
86 lines
3.9 KiB
JavaScript
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const { test } = require('node:test');
|
|
const yaml = require('js-yaml');
|
|
|
|
const ROOT = path.resolve(__dirname, '../..');
|
|
|
|
function document(relativePath) {
|
|
return yaml.load(fs.readFileSync(path.join(ROOT, relativePath), 'utf8'));
|
|
}
|
|
|
|
test('keeps strong Run management opt-in, private and least-resource', () => {
|
|
const directory = 'deploy/kubernetes/ql3-cluster/operations/run-management/base';
|
|
const deployment = document(`${directory}/deployment.yaml`);
|
|
const service = document(`${directory}/service.yaml`);
|
|
const policy = document(`${directory}/network-policy.yaml`);
|
|
const kustomization = document(`${directory}/kustomization.yaml`);
|
|
const container = deployment.spec.template.spec.containers[0];
|
|
const environment = new Map(container.env.map((entry) => [entry.name, entry]));
|
|
|
|
assert.equal(deployment.metadata.name, 'ql3-run-management');
|
|
assert.equal(deployment.spec.replicas, 2);
|
|
assert.equal(deployment.spec.template.spec.automountServiceAccountToken, false);
|
|
assert.equal(container.securityContext.readOnlyRootFilesystem, true);
|
|
assert.equal(container.securityContext.allowPrivilegeEscalation, false);
|
|
assert.deepEqual(container.securityContext.capabilities.drop, ['ALL']);
|
|
assert.deepEqual(container.command, [
|
|
'node',
|
|
'/opt/qinglong/node_modules/@qinglong/cluster-admin/dist/run-management/runManagementCli.js',
|
|
]);
|
|
assert.equal(environment.get('QL3_RUN_MANAGEMENT_ENABLED').value, 'true');
|
|
assert.equal(environment.get('QL3_RUN_MANAGEMENT_PORT').value, '8448');
|
|
assert.equal(environment.get('QL3_POSTGRES_RUN_MANAGER_POOL_MAX').value, '2');
|
|
assert.equal(container.resources.requests.memory, '96Mi');
|
|
assert.equal(service.spec.type, 'ClusterIP');
|
|
assert.equal(service.spec.ports[0].port, 8448);
|
|
assert.equal(policy.spec.ingress[0].from[0].podSelector.matchLabels['qinglong.io/run-management-client'], 'true');
|
|
assert.equal(policy.spec.egress.length, 1);
|
|
assert.deepEqual(kustomization.resources, [
|
|
'service-account.yaml',
|
|
'service.yaml',
|
|
'deployment.yaml',
|
|
'pod-disruption-budget.yaml',
|
|
'network-policy.yaml',
|
|
]);
|
|
|
|
for (const defaultPath of [
|
|
'deploy/kubernetes/ql3-cluster/base/kustomization.yaml',
|
|
'deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg/kustomization.yaml',
|
|
]) {
|
|
assert.doesNotMatch(fs.readFileSync(path.join(ROOT, defaultPath), 'utf8'), /run-management/);
|
|
}
|
|
});
|
|
|
|
test('binds the CloudNativePG overlay only to the dedicated Run manager role', () => {
|
|
const directory = 'deploy/kubernetes/ql3-cluster/operations/run-management/cloudnative-pg';
|
|
const patch = yaml.load(fs.readFileSync(path.join(ROOT, directory, 'deployment-patch.yaml'), 'utf8'));
|
|
const environment = new Map(patch[0].value.map((entry) => [entry.name, entry]));
|
|
const policy = document(`${directory}/network-policy-patch.yaml`);
|
|
const manifest = JSON.parse(
|
|
fs.readFileSync(path.join(ROOT, 'packages/ql3-cluster-admin/package.json'), 'utf8'),
|
|
);
|
|
|
|
assert.equal(environment.has('QL3_POSTGRES_RUN_MANAGER_URL'), false);
|
|
assert.equal(
|
|
environment.get('QL3_POSTGRES_RUN_MANAGER_USER').valueFrom.secretKeyRef.name,
|
|
'ql3-postgres-run-manager-auth',
|
|
);
|
|
assert.equal(
|
|
environment.get('QL3_POSTGRES_RUN_MANAGER_PASSWORD').valueFrom.secretKeyRef.name,
|
|
'ql3-postgres-run-manager-auth',
|
|
);
|
|
assert.equal(environment.get('QL3_POSTGRES_RUN_MANAGER_HOST').value, 'ql3-postgres-rw.qinglong3-system.svc');
|
|
assert.equal(policy.spec.egress.length, 2);
|
|
assert.deepEqual(policy.spec.egress[1].to[0].podSelector.matchLabels, {
|
|
'cnpg.io/cluster': 'ql3-postgres',
|
|
});
|
|
assert.equal(manifest.bin['ql3-run-manage'], 'dist/run-management/runManagementCli.js');
|
|
assert.equal(manifest.bin['ql3-run-client'], 'dist/run-management/runManagementClientCli.js');
|
|
assert.equal(
|
|
manifest.exports['./run-management-process'].require,
|
|
'./dist/run-management/runManagementProcess.js',
|
|
);
|
|
});
|