mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-21 01:32:44 +08:00
1556 lines
50 KiB
JavaScript
1556 lines
50 KiB
JavaScript
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const { test } = require('node:test');
|
|
const {
|
|
auditClusterDeployment,
|
|
} = require('../../scripts/ql3-cluster-deployment-audit.cjs');
|
|
const {
|
|
readReleaseIdentity,
|
|
} = require('../../scripts/lib/ql3-release-identity.cjs');
|
|
|
|
const ROOT = path.resolve(__dirname, '../..');
|
|
const VERSION = readReleaseIdentity(ROOT).version;
|
|
|
|
function intercept(relativePath, transform) {
|
|
const target = path.join(ROOT, relativePath);
|
|
return (filePath, encoding) => {
|
|
const value = fs.readFileSync(filePath, encoding);
|
|
return path.resolve(filePath) === target ? transform(value) : value;
|
|
};
|
|
}
|
|
|
|
test('accepts the exact locked non-root multi-replica cluster deployment', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(report.kubernetesReplicas, 2);
|
|
assert.equal(report.migrationJob, 'explicit-one-shot');
|
|
assert.equal(report.pluginPackageRecoveryJob, 'explicit-one-shot');
|
|
assert.equal(report.imageReleasePins, 'independent-fail-closed-digests');
|
|
assert.equal(report.clusterAi, 'optional-projected-authority');
|
|
assert.equal(
|
|
report.clusterAiPromptOutput,
|
|
'optional-read-only-projected-keyring',
|
|
);
|
|
assert.equal(report.clusterCopilotMcpHost, 'external-host-stdio');
|
|
assert.equal(report.promptOutputKeyRotation, 'caller-driven-staged-material');
|
|
assert.equal(report.clusterAdminImageReferences, 26);
|
|
assert.deepEqual(report.workspacePackages, [
|
|
'@qinglong/runtime-core',
|
|
'@qinglong/cluster-postgres',
|
|
'@qinglong/cluster-control',
|
|
]);
|
|
assert.deepEqual(report.adminWorkspacePackages, [
|
|
'@qinglong/runtime-core',
|
|
'@qinglong/cluster-postgres',
|
|
'@qinglong/cluster-admin',
|
|
]);
|
|
});
|
|
|
|
test('keeps Cluster Copilot MCP external, digest-pinned and resource-bounded', () => {
|
|
const widened = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/mcp/ql3-cluster-copilot/docker-stdio.sh',
|
|
(source) => source.replace('--network "$network"', '--network host'),
|
|
),
|
|
});
|
|
assert.equal(widened.compatible, false);
|
|
assert.equal(
|
|
widened.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_COPILOT_MCP_HOST_CONTRACT_DRIFT',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const resident = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/base/deployment.yaml',
|
|
(source) => `${source}\n# ql3-copilot-mcp\n`,
|
|
),
|
|
});
|
|
assert.equal(resident.compatible, false);
|
|
assert.equal(
|
|
resident.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_COPILOT_MCP_KUBERNETES_RESIDENT',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('requires every Cluster Admin Kubernetes workload to override the image command', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/approval-management/base/deployment.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' command:\n - node\n - /opt/qinglong/node_modules/@qinglong/cluster-admin/dist/approval-management/approvalManagementCli.js\n',
|
|
'',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(report.clusterAdminImageReferences, 26);
|
|
assert.equal(
|
|
report.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_ADMIN_IMAGE_COMMAND_IMPLICIT',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects widened Plugin Package Secret action Kubernetes authority', () => {
|
|
const widenedRole = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/role.yaml',
|
|
(source) =>
|
|
source.replace(' - get\n', ' - get\n - list\n'),
|
|
),
|
|
});
|
|
assert.equal(widenedRole.compatible, false);
|
|
assert.equal(
|
|
widenedRole.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PLUGIN_EXECUTOR_KUBERNETES_AUTHORITY',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const ignoredAdmissionFailure = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/validating-admission-policy.yaml',
|
|
(source) =>
|
|
source.replace('failurePolicy: Fail', 'failurePolicy: Ignore'),
|
|
),
|
|
});
|
|
assert.equal(ignoredAdmissionFailure.compatible, false);
|
|
assert.equal(
|
|
ignoredAdmissionFailure.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PLUGIN_EXECUTOR_KUBERNETES_AUTHORITY',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const actionToken = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/secret-action-service-account.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'automountServiceAccountToken: false',
|
|
'automountServiceAccountToken: true',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(actionToken.compatible, false);
|
|
assert.equal(
|
|
actionToken.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PLUGIN_EXECUTOR_LIFECYCLE',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('requires the bounded Cluster product facade and image entrypoint', () => {
|
|
const missingBinary = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept('packages/ql3-cluster-admin/package.json', (source) => {
|
|
const manifest = JSON.parse(source);
|
|
delete manifest.bin['ql3-cluster-admin'];
|
|
return JSON.stringify(manifest);
|
|
}),
|
|
});
|
|
assert.equal(missingBinary.compatible, false);
|
|
assert.equal(
|
|
missingBinary.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PLUGIN_RECOVERY_ENTRYPOINT_MISSING',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const legacyEntrypoint = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/containers/ql3-cluster-admin/Dockerfile',
|
|
(source) =>
|
|
source.replace(
|
|
'dist/product-cli/cli.js',
|
|
'dist/plugin-package/recovery/pluginPackageRecoveryCli.js',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(legacyEntrypoint.compatible, false);
|
|
assert.equal(
|
|
legacyEntrypoint.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_ADMIN_DOCKERFILE_CONTRACT_MISSING',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('ships a path-only Cluster operator context example without durable authority', () => {
|
|
const example = JSON.parse(
|
|
fs.readFileSync(
|
|
path.join(
|
|
ROOT,
|
|
'deploy/kubernetes/ql3-cluster/operator-context.example.json',
|
|
),
|
|
'utf8',
|
|
),
|
|
);
|
|
assert.deepEqual(Object.keys(example).sort(), ['commands', 'schemaVersion']);
|
|
assert.equal(example.schemaVersion, 1);
|
|
assert.deepEqual(Object.keys(example.commands).sort(), [
|
|
'approval',
|
|
'automation',
|
|
'copilot',
|
|
'model-credential',
|
|
'package',
|
|
'package-kubernetes',
|
|
'run',
|
|
'worker',
|
|
'worker-credential',
|
|
]);
|
|
for (const [name, command] of Object.entries(example.commands)) {
|
|
assert.deepEqual(
|
|
Object.keys(command).sort(),
|
|
name === 'package-kubernetes'
|
|
? ['configFile', 'kubernetesFile']
|
|
: ['configFile'],
|
|
);
|
|
for (const value of Object.values(command)) {
|
|
assert.match(value, /^\/secure\/qinglong3\/[a-z0-9-]+\.json$/);
|
|
}
|
|
}
|
|
assert.doesNotMatch(
|
|
JSON.stringify(example),
|
|
/assertion|commandFile|privateKey|token|password|secret/i,
|
|
);
|
|
});
|
|
|
|
test('keeps Cluster AI optional with projected authority and an independent digest', () => {
|
|
const defaultEnabled = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/base/deployment.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
`image: qinglong3-cluster-control:${VERSION}`,
|
|
`image: qinglong3-cluster-control-ai:${VERSION}`,
|
|
),
|
|
),
|
|
});
|
|
assert.equal(defaultEnabled.compatible, false);
|
|
assert.ok(
|
|
defaultEnabled.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_AI_DEFAULT_ENABLED',
|
|
),
|
|
);
|
|
|
|
const writableProjection = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/components/cluster-ai/deployment-patch.yaml',
|
|
(source) => source.replaceAll('defaultMode: 288', 'defaultMode: 416'),
|
|
),
|
|
});
|
|
assert.equal(writableProjection.compatible, false);
|
|
assert.ok(
|
|
writableProjection.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_AI_COMPONENT_AUTHORITY',
|
|
),
|
|
);
|
|
|
|
const tagBased = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/overlays/cluster-ai-example/kustomization.yaml',
|
|
(source) => source.replace(/digest: sha256:0{64}/, `newTag: ${VERSION}`),
|
|
),
|
|
});
|
|
assert.equal(tagBased.compatible, false);
|
|
assert.ok(
|
|
tagBased.findings.some(({ code }) => code === 'QL3_CLUSTER_AI_IMAGE_PIN'),
|
|
);
|
|
});
|
|
|
|
test('keeps durable Cluster AI Prompt output opt-in and read-only', () => {
|
|
const enabledByBaseAi = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/components/cluster-ai/deployment-patch.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' - name: QL3_CLUSTER_AI_DATABASE_MAX_CONNECTIONS\n value: "4"',
|
|
' - name: QL3_CLUSTER_AI_DATABASE_MAX_CONNECTIONS\n value: "4"\n - name: QL3_CLUSTER_AI_PROMPT_OUTPUT_ENABLED\n value: "true"',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(enabledByBaseAi.compatible, false);
|
|
assert.ok(
|
|
enabledByBaseAi.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_AI_COMPONENT_AUTHORITY',
|
|
),
|
|
);
|
|
|
|
const writableKeyring = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/components/cluster-ai-prompt-output/deployment-patch.yaml',
|
|
(source) => source.replace('defaultMode: 288', 'defaultMode: 416'),
|
|
),
|
|
});
|
|
assert.equal(writableKeyring.compatible, false);
|
|
assert.ok(
|
|
writableKeyring.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_AI_PROMPT_OUTPUT_PROJECTION',
|
|
),
|
|
);
|
|
|
|
const writableMount = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/components/cluster-ai-prompt-output/deployment-patch.yaml',
|
|
(source) => source.replace('readOnly: true', 'readOnly: false'),
|
|
),
|
|
});
|
|
assert.equal(writableMount.compatible, false);
|
|
assert.ok(
|
|
writableMount.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_AI_PROMPT_OUTPUT_PROJECTION',
|
|
),
|
|
);
|
|
|
|
const widenedProjection = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/components/cluster-ai-prompt-output/deployment-patch.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'items:\n - key: keyring.json\n path: keyring.json',
|
|
'optional: true',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(widenedProjection.compatible, false);
|
|
assert.ok(
|
|
widenedProjection.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_AI_PROMPT_OUTPUT_PROJECTION',
|
|
),
|
|
);
|
|
|
|
const incompleteOverlay = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/overlays/cluster-ai-prompt-output-example/kustomization.yaml',
|
|
(source) => source.replace(' - ../../components/cluster-ai\n', ''),
|
|
),
|
|
});
|
|
assert.equal(incompleteOverlay.compatible, false);
|
|
assert.ok(
|
|
incompleteOverlay.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_AI_PROMPT_OUTPUT_OVERLAY',
|
|
),
|
|
);
|
|
});
|
|
|
|
test('keeps Prompt output active-key rotation caller-driven and least privilege', () => {
|
|
const widenedRbac = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/prompt-output-key-rotation/base/role.yaml',
|
|
(source) =>
|
|
source.replace(' - update', ' - update\n - create'),
|
|
),
|
|
});
|
|
assert.equal(widenedRbac.compatible, false);
|
|
assert.ok(
|
|
widenedRbac.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PROMPT_OUTPUT_KEY_ROTATION_RBAC',
|
|
),
|
|
);
|
|
|
|
const broadMaterial = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/prompt-output-key-rotation/base/job.yaml',
|
|
(source) => source.replace(' subPath: material.bin\n', ''),
|
|
),
|
|
});
|
|
assert.equal(broadMaterial.compatible, false);
|
|
assert.ok(
|
|
broadMaterial.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_PROMPT_OUTPUT_KEY_ROTATION_FILE_BOUNDARY',
|
|
),
|
|
);
|
|
|
|
const publicEgress = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/prompt-output-key-rotation/base/network-policy.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' egress:',
|
|
' egress:\n - to:\n - ipBlock:\n cidr: 0.0.0.0/0',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(publicEgress.compatible, false);
|
|
assert.ok(
|
|
publicEgress.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_PROMPT_OUTPUT_KEY_ROTATION_NETWORK_POLICY',
|
|
),
|
|
);
|
|
});
|
|
|
|
test('rejects mutable or overridable Cluster image bases', () => {
|
|
const buildDigest =
|
|
'@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d';
|
|
const runtimeDigest =
|
|
'@sha256:595398b0081eacda8e1c4c5b97b76cd1020e4d58a8ebcb4843b9bca1e79e7436';
|
|
const control = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/containers/ql3-cluster-control/Dockerfile',
|
|
(source) => source.replace(buildDigest, ''),
|
|
),
|
|
});
|
|
assert.equal(control.compatible, false);
|
|
assert.equal(
|
|
control.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_DOCKERFILE_BASE_IMAGE_NOT_PINNED',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const admin = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/containers/ql3-cluster-admin/Dockerfile',
|
|
(source) =>
|
|
`ARG NODE_IMAGE=node:24.18.0-bookworm-slim\n${source.replaceAll(
|
|
`node:24.18.0-bookworm-slim${buildDigest}`,
|
|
'${NODE_IMAGE}',
|
|
)}`,
|
|
),
|
|
});
|
|
assert.equal(admin.compatible, false);
|
|
assert.equal(
|
|
admin.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_ADMIN_DOCKERFILE_BASE_IMAGE_NOT_PINNED',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const runtimeControl = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/containers/ql3-cluster-control/Dockerfile',
|
|
(source) => source.replace(runtimeDigest, ''),
|
|
),
|
|
});
|
|
assert.equal(runtimeControl.compatible, false);
|
|
assert.equal(
|
|
runtimeControl.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_DOCKERFILE_BASE_IMAGE_NOT_PINNED',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('keeps authenticated Plugin Package management optional and bounded', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(report.pluginPackageManagement, 'optional-authenticated-https');
|
|
});
|
|
|
|
test('keeps authenticated Worker credential management optional and isolated', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(
|
|
report.workerCredentialManagement,
|
|
'optional-authenticated-https',
|
|
);
|
|
});
|
|
|
|
test('keeps authenticated automation management optional and isolated', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(report.automationManagement, 'optional-authenticated-https');
|
|
});
|
|
|
|
test('keeps authenticated human Approval management optional and isolated', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(report.approvalManagement, 'optional-authenticated-https');
|
|
});
|
|
|
|
test('rejects Approval management authority or entrypoint widening', () => {
|
|
const publicEgress = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/approval-management/base/network-policy.yaml',
|
|
(source) => source.replace('k8s-app: kube-dns', 'k8s-app: public-proxy'),
|
|
),
|
|
});
|
|
assert.equal(publicEgress.compatible, false);
|
|
assert.equal(
|
|
publicEgress.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_APPROVAL_MANAGEMENT_AUTHORITY',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const missingEntrypoint = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept('packages/ql3-cluster-admin/package.json', (source) => {
|
|
const manifest = JSON.parse(source);
|
|
delete manifest.bin['ql3-approval-manage'];
|
|
return JSON.stringify(manifest);
|
|
}),
|
|
});
|
|
assert.equal(missingEntrypoint.compatible, false);
|
|
assert.equal(
|
|
missingEntrypoint.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_APPROVAL_MANAGEMENT_BOUNDARY',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects automation management authority or database role widening', () => {
|
|
const publicEgress = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/automation-management/base/network-policy.yaml',
|
|
(source) => source.replace('k8s-app: kube-dns', 'k8s-app: public-proxy'),
|
|
),
|
|
});
|
|
assert.equal(publicEgress.compatible, false);
|
|
assert.equal(
|
|
publicEgress.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_AUTOMATION_MANAGEMENT_AUTHORITY',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const wrongRole = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/automation-management/cloudnative-pg/deployment-patch.yaml',
|
|
(source) =>
|
|
source.replaceAll(
|
|
'ql3-postgres-automation-manager-auth',
|
|
'ql3-postgres-admin-auth',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(wrongRole.compatible, false);
|
|
assert.equal(
|
|
wrongRole.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_AUTOMATION_MANAGEMENT_CLOUDNATIVE_PG_AUTHORITY',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const missingEntrypoint = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept('packages/ql3-cluster-admin/package.json', (source) => {
|
|
const manifest = JSON.parse(source);
|
|
delete manifest.bin['ql3-automation-manage'];
|
|
return JSON.stringify(manifest);
|
|
}),
|
|
});
|
|
assert.equal(missingEntrypoint.compatible, false);
|
|
assert.equal(
|
|
missingEntrypoint.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_AUTOMATION_MANAGEMENT_BOUNDARY',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('keeps the automation management client caller-driven and one-shot', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(report.automationManagementClient, 'caller-driven-one-shot');
|
|
});
|
|
|
|
test('keeps the Approval management client caller-driven and one-shot', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(report.approvalManagementClient, 'caller-driven-one-shot');
|
|
});
|
|
|
|
test('rejects widened lifecycle, authority or public inputs in the Approval client', () => {
|
|
for (const [relativePath, transform, findingCode] of [
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/approval-management-client/base/job.yaml',
|
|
(source) => source.replace('backoffLimit: 0', 'backoffLimit: 1'),
|
|
'QL3_CLUSTER_APPROVAL_MANAGEMENT_CLIENT_LIFECYCLE',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/approval-management-client/base/job.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'approvalManagementClientCli.js',
|
|
'approvalManagementCli.js',
|
|
),
|
|
'QL3_CLUSTER_APPROVAL_MANAGEMENT_CLIENT_ENTRYPOINT',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/approval-management-client/base/job.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'secretName: ql3-approval-management-assertion',
|
|
'secretName: ql3-approval-management-tls',
|
|
),
|
|
'QL3_CLUSTER_APPROVAL_MANAGEMENT_CLIENT_FILE_BOUNDARY',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/approval-management-client/base/network-policy.yaml',
|
|
(source) => source.replace(' port: 8447', ' port: 443'),
|
|
'QL3_CLUSTER_APPROVAL_MANAGEMENT_CLIENT_NETWORK_POLICY',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/approval-management-client/kustomization.yaml',
|
|
(source) => source.replace(/digest: sha256:0{64}/, `newTag: ${VERSION}`),
|
|
'QL3_CLUSTER_APPROVAL_MANAGEMENT_CLIENT_OPT_IN',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/approval-management-client/config.example.yaml',
|
|
(source) => source.replace('kind: Secret', 'kind: ConfigMap'),
|
|
'QL3_CLUSTER_APPROVAL_MANAGEMENT_CLIENT_INPUT_BOUNDARY',
|
|
],
|
|
]) {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(relativePath, transform),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(({ code }) => code === findingCode),
|
|
true,
|
|
);
|
|
}
|
|
});
|
|
|
|
test('rejects widened lifecycle, authority or public inputs in the automation client', () => {
|
|
for (const [relativePath, transform, findingCode] of [
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/automation-management-client/base/job.yaml',
|
|
(source) => source.replace('backoffLimit: 0', 'backoffLimit: 1'),
|
|
'QL3_CLUSTER_AUTOMATION_MANAGEMENT_CLIENT_LIFECYCLE',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/automation-management-client/base/job.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'automationManagementClientCli.js',
|
|
'automationManagementCli.js',
|
|
),
|
|
'QL3_CLUSTER_AUTOMATION_MANAGEMENT_CLIENT_ENTRYPOINT',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/automation-management-client/base/job.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' - name: request\n secret:',
|
|
' - name: request\n configMap:',
|
|
),
|
|
'QL3_CLUSTER_AUTOMATION_MANAGEMENT_CLIENT_FILE_BOUNDARY',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/automation-management-client/base/network-policy.yaml',
|
|
(source) => source.replace(' port: 8445', ' port: 443'),
|
|
'QL3_CLUSTER_AUTOMATION_MANAGEMENT_CLIENT_NETWORK_POLICY',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/automation-management-client/kustomization.yaml',
|
|
(source) => source.replace(/digest: sha256:0{64}/, `newTag: ${VERSION}`),
|
|
'QL3_CLUSTER_AUTOMATION_MANAGEMENT_CLIENT_RELEASE_DIGEST_PIN',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/kustomization.yaml',
|
|
(source) => `${source} - automation-management-client/base\n`,
|
|
'QL3_CLUSTER_AUTOMATION_MANAGEMENT_CLIENT_DEFAULT_ENABLED',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/automation-management-client/config.example.yaml',
|
|
(source) => source.replace('kind: Secret', 'kind: ConfigMap'),
|
|
'QL3_CLUSTER_AUTOMATION_MANAGEMENT_CLIENT_INPUT_BOUNDARY',
|
|
],
|
|
]) {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(relativePath, transform),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(({ code }) => code === findingCode),
|
|
true,
|
|
);
|
|
}
|
|
});
|
|
|
|
test('keeps the Worker credential management client caller-driven and one-shot', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(
|
|
report.workerCredentialManagementClient,
|
|
'caller-driven-one-shot',
|
|
);
|
|
});
|
|
|
|
test('rejects widened authority or lifecycle in the Worker management client', () => {
|
|
for (const [relativePath, transform, findingCode] of [
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management-client/base/job.yaml',
|
|
(source) => source.replace('backoffLimit: 0', 'backoffLimit: 1'),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CLIENT_LIFECYCLE',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management-client/base/job.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'workerCredentialManagementClientCli.js',
|
|
'workerCredentialManagementCli.js',
|
|
),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CLIENT_ENTRYPOINT',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management-client/base/job.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'secretName: ql3-worker-credential-management-assertion',
|
|
'secretName: ql3-worker-credential-management-tls',
|
|
),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CLIENT_FILE_BOUNDARY',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management-client/base/network-policy.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' egress:\n - to:',
|
|
' egress:\n - {}\n - to:',
|
|
),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CLIENT_NETWORK_POLICY',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management-client/kustomization.yaml',
|
|
(source) => source.replace(/digest: sha256:0{64}/, `newTag: ${VERSION}`),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CLIENT_RELEASE_DIGEST_PIN',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/kustomization.yaml',
|
|
(source) => `${source} - worker-credential-management-client/base\n`,
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CLIENT_DEFAULT_ENABLED',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management-client/config.example.yaml',
|
|
(source) => source.replace('immutable: true', 'immutable: false'),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CLIENT_INPUT_BOUNDARY',
|
|
],
|
|
]) {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(relativePath, transform),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(({ code }) => code === findingCode),
|
|
true,
|
|
);
|
|
}
|
|
});
|
|
|
|
test('requires both read-only Worker and credential-compatible client entrypoints', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept('packages/ql3-cluster-admin/package.json', (source) => {
|
|
const manifest = JSON.parse(source);
|
|
delete manifest.bin['ql3-worker-credential-client'];
|
|
delete manifest.bin['ql3-worker-client'];
|
|
delete manifest.exports['./worker-credential-management-client'];
|
|
delete manifest.exports['./worker-management-client'];
|
|
delete manifest.exports['./worker-management-product'];
|
|
return JSON.stringify(manifest);
|
|
}),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PLUGIN_RECOVERY_ENTRYPOINT_MISSING',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('keeps Worker credential execution caller-driven and one-shot', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(report.workerCredentialExecutor, 'caller-driven-one-shot');
|
|
});
|
|
|
|
test('rejects widened issuer token, RBAC or database authority in Worker execution', () => {
|
|
for (const [relativePath, transform, findingCode] of [
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-executor/base/job.yaml',
|
|
(source) =>
|
|
source.replace('expirationSeconds: 600', 'expirationSeconds: 3600'),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_EXECUTOR_FILE_AUTHORITY',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-executor/base/token-issuer-role-binding.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'name: ql3-worker-credential-token-issuer',
|
|
'name: ql3-worker-credential-target-admin',
|
|
),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_EXECUTOR_ISSUER_RBAC',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-executor/base/job.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'QL3_POSTGRES_WORKER_CREDENTIAL_EXECUTOR_URL',
|
|
'QL3_POSTGRES_WORKER_CREDENTIAL_MANAGER_URL',
|
|
),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_EXECUTOR_DATABASE_AUTHORITY',
|
|
],
|
|
]) {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(relativePath, transform),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(({ code }) => code === findingCode),
|
|
true,
|
|
);
|
|
}
|
|
});
|
|
|
|
test('rejects recurring, default-enabled or public-egress Worker execution', () => {
|
|
for (const [relativePath, transform, findingCode] of [
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-executor/base/job.yaml',
|
|
(source) => source.replace('kind: Job', 'kind: CronJob'),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_EXECUTOR_LIFECYCLE',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/kustomization.yaml',
|
|
(source) => `${source} - worker-credential-executor/base\n`,
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_EXECUTOR_DEFAULT_ENABLED',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-executor/base/network-policy.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' egress:\n - to:',
|
|
' egress:\n - {}\n - to:',
|
|
),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_EXECUTOR_NETWORK_POLICY',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-executor/cloudnative-pg/kustomization.yaml',
|
|
(source) => source.replace(/digest: sha256:0{64}/, `newTag: ${VERSION}`),
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_EXECUTOR_CLOUDNATIVE_PG_AUTHORITY',
|
|
],
|
|
]) {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(relativePath, transform),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(({ code }) => code === findingCode),
|
|
true,
|
|
);
|
|
}
|
|
});
|
|
|
|
test('rejects executor authority or public egress in Worker management', () => {
|
|
const databaseAuthority = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management/base/deployment.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'QL3_POSTGRES_WORKER_CREDENTIAL_MANAGER_URL',
|
|
'QL3_POSTGRES_WORKER_CREDENTIAL_EXECUTOR_URL',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(databaseAuthority.compatible, false);
|
|
assert.ok(
|
|
databaseAuthority.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_DATABASE_AUTHORITY',
|
|
),
|
|
);
|
|
|
|
const publicEgress = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management/base/network-policy.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' egress:\n - to:',
|
|
' egress:\n - {}\n - to:',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(publicEgress.compatible, false);
|
|
assert.ok(
|
|
publicEgress.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_NETWORK_POLICY',
|
|
),
|
|
);
|
|
});
|
|
|
|
test('rejects default or tag-based Worker management rollout', () => {
|
|
const defaultEnabled = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/kustomization.yaml',
|
|
(source) => `${source} - worker-credential-management/base\n`,
|
|
),
|
|
});
|
|
assert.equal(defaultEnabled.compatible, false);
|
|
assert.ok(
|
|
defaultEnabled.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_DEFAULT_ENABLED',
|
|
),
|
|
);
|
|
|
|
const tagBased = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management/cloudnative-pg/kustomization.yaml',
|
|
(source) => source.replace(/digest: sha256:0{64}/, `newTag: ${VERSION}`),
|
|
),
|
|
});
|
|
assert.equal(tagBased.compatible, false);
|
|
assert.ok(
|
|
tagBased.findings.some(
|
|
({ code }) =>
|
|
code ===
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CLOUDNATIVE_PG_AUTHORITY',
|
|
),
|
|
);
|
|
});
|
|
|
|
test('requires an explicit Worker management CRL rollout evidence annotation', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management/base/deployment.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
/\n\s+qinglong\.io\/worker-credential-management-client-crl-sha256: sha256:0{64}/,
|
|
'',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.ok(
|
|
report.findings.some(
|
|
({ code }) =>
|
|
code ===
|
|
'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CRL_ROLLOUT_EVIDENCE',
|
|
),
|
|
);
|
|
});
|
|
|
|
test('requires an explicit Worker management CA rollout evidence annotation', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/worker-credential-management/base/deployment.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
/\n\s+qinglong\.io\/worker-credential-management-client-ca-sha256: sha256:0{64}/,
|
|
'',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.ok(
|
|
report.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_WORKER_CREDENTIAL_MANAGEMENT_CA_ROLLOUT_EVIDENCE',
|
|
),
|
|
);
|
|
});
|
|
|
|
test('requires the private Plugin Package management client export and binary', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept('packages/ql3-cluster-admin/package.json', (source) => {
|
|
const manifest = JSON.parse(source);
|
|
delete manifest.bin['ql3-plugin-package-client'];
|
|
delete manifest.exports['./plugin-package-management-client'];
|
|
return JSON.stringify(manifest);
|
|
}),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PLUGIN_RECOVERY_ENTRYPOINT_MISSING',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('requires the private Kubernetes management tunnel export and binary', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept('packages/ql3-cluster-admin/package.json', (source) => {
|
|
const manifest = JSON.parse(source);
|
|
delete manifest.bin['ql3-plugin-package-client-kubernetes'];
|
|
delete manifest.exports['./plugin-package-management-kubernetes-client'];
|
|
return JSON.stringify(manifest);
|
|
}),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PLUGIN_RECOVERY_ENTRYPOINT_MISSING',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects public management egress or widened CloudNativePG destinations', () => {
|
|
const publicEgress = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-management/base/network-policy.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' egress:\n - to:',
|
|
' egress:\n - {}\n - to:',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(publicEgress.compatible, false);
|
|
assert.ok(
|
|
publicEgress.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PLUGIN_MANAGEMENT_NETWORK_POLICY',
|
|
),
|
|
);
|
|
|
|
const widenedPostgres = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-management/cloudnative-pg/network-policy-patch.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' cnpg.io/cluster: ql3-postgres',
|
|
' app.kubernetes.io/part-of: qinglong3',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(widenedPostgres.compatible, false);
|
|
assert.ok(
|
|
widenedPostgres.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_PLUGIN_MANAGEMENT_CLOUDNATIVE_PG_AUTHORITY',
|
|
),
|
|
);
|
|
});
|
|
|
|
test('rejects Kubernetes API or executor authority in Package management', () => {
|
|
const kubernetesAuthority = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-management/base/deployment.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'automountServiceAccountToken: false',
|
|
'automountServiceAccountToken: true',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(kubernetesAuthority.compatible, false);
|
|
assert.equal(
|
|
kubernetesAuthority.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_PLUGIN_MANAGEMENT_LIFECYCLE',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const databaseAuthority = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-management/base/deployment.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'QL3_POSTGRES_PACKAGE_MANAGER_URL',
|
|
'QL3_POSTGRES_PACKAGE_EXECUTOR_URL',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(databaseAuthority.compatible, false);
|
|
assert.equal(
|
|
databaseAuthority.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_PLUGIN_MANAGEMENT_DATABASE_AUTHORITY',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects default enablement or tag-based Package management rollout', () => {
|
|
const defaultEnabled = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/kustomization.yaml',
|
|
(source) => `${source} - plugin-package-management/base\n`,
|
|
),
|
|
});
|
|
assert.equal(defaultEnabled.compatible, false);
|
|
assert.equal(
|
|
defaultEnabled.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_PLUGIN_MANAGEMENT_DEFAULT_ENABLED',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const tagBased = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-management/cloudnative-pg/kustomization.yaml',
|
|
(source) => source.replace(/digest: sha256:0{64}/, `newTag: ${VERSION}`),
|
|
),
|
|
});
|
|
assert.equal(tagBased.compatible, false);
|
|
assert.equal(
|
|
tagBased.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_PLUGIN_MANAGEMENT_RELEASE_DIGEST_PIN',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects a recovery-writable ConfigMap as the management identity root', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-management/base/deployment.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' - name: management-identity\n secret:\n secretName: ql3-plugin-package-management-identity',
|
|
' - name: management-identity\n configMap:\n name: ql3-plugin-package-management-identity',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_PLUGIN_MANAGEMENT_FILE_BINDING',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects a single-replica cluster-control deployment', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/base/deployment.yaml',
|
|
(source) => source.replace('replicas: 2', 'replicas: 1'),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) => candidate.code === 'QL3_CLUSTER_KUBERNETES_REPLICA_FLOOR',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects image dependency widening beyond the reviewed QL3 closure', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/containers/ql3-cluster-control/package.json',
|
|
(source) => {
|
|
const manifest = JSON.parse(source);
|
|
manifest.dependencies.express = '4.22.2';
|
|
return JSON.stringify(manifest);
|
|
},
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) => candidate.code === 'QL3_CLUSTER_IMAGE_DEPENDENCY_DRIFT',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects image builder dependency widening beyond the reviewed toolchain', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/containers/ql3-cluster-control/package.json',
|
|
(source) => {
|
|
const manifest = JSON.parse(source);
|
|
manifest.devDependencies.esbuild = '0.25.12';
|
|
return JSON.stringify(manifest);
|
|
},
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_IMAGE_BUILD_DEPENDENCY_DRIFT',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects cluster-admin image dependency widening', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/containers/ql3-cluster-admin/package.json',
|
|
(source) => {
|
|
const manifest = JSON.parse(source);
|
|
manifest.dependencies.express = '4.22.2';
|
|
return JSON.stringify(manifest);
|
|
},
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_ADMIN_IMAGE_DEPENDENCY_DRIFT',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects inline runtime credentials and a privileged container', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/base/deployment.yaml',
|
|
(source) =>
|
|
source
|
|
.replace(
|
|
/valueFrom:\n\s+secretKeyRef:\n\s+name: ql3-cluster-control-runtime\n\s+key: postgres-runtime-url/,
|
|
'value: postgresql://inline-secret',
|
|
)
|
|
.replace(
|
|
'allowPrivilegeEscalation: false',
|
|
'allowPrivilegeEscalation: true',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) => candidate.code === 'QL3_CLUSTER_KUBERNETES_SECRET_BINDING',
|
|
),
|
|
true,
|
|
);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_KUBERNETES_SECURITY_CONTEXT',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects migration authority in the runtime secret domain', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/base/migrate-job.yaml',
|
|
(source) =>
|
|
source
|
|
.replace(
|
|
'name: ql3-cluster-migration\n key: postgres-migration-url',
|
|
'name: ql3-cluster-control-runtime\n key: postgres-migration-url',
|
|
)
|
|
.replace(
|
|
'name: QL3_POSTGRES_MIGRATION_URL',
|
|
'name: QL3_POSTGRES_RUNTIME_URL',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) => candidate.code === 'QL3_CLUSTER_MIGRATION_AUTHORITY',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects PostgreSQL CA paths or Secret projections outside the reviewed domains', () => {
|
|
const runtime = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/base/deployment.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'/var/run/secrets/qinglong3/postgres-runtime/ca.crt',
|
|
'/tmp/postgres-ca.crt',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(runtime.compatible, false);
|
|
assert.equal(
|
|
runtime.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_KUBERNETES_ENVIRONMENT_GATE',
|
|
),
|
|
true,
|
|
);
|
|
|
|
const migration = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/base/migrate-job.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
'secretName: ql3-cluster-migration',
|
|
'secretName: ql3-cluster-control-runtime',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(migration.compatible, false);
|
|
assert.equal(
|
|
migration.findings.some(
|
|
(candidate) =>
|
|
candidate.code === 'QL3_CLUSTER_MIGRATION_POSTGRES_CA_BINDING',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects widened Plugin Package recovery RBAC', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-recovery/base/rbac.yaml',
|
|
(source) =>
|
|
source
|
|
.replace(
|
|
'resources:\n - configmaps',
|
|
'resources:\n - configmaps\n - secrets',
|
|
)
|
|
.replace(
|
|
' - update',
|
|
' - update\n - delete\n - list\n - watch',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) => candidate.code === 'QL3_CLUSTER_PLUGIN_RECOVERY_RBAC',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects a broad or shared private Registry credential projection', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-recovery/private-registry/recover-job-patch.yaml',
|
|
(source) =>
|
|
source
|
|
.replace(
|
|
'secretName: ql3-plugin-package-registry-credentials',
|
|
'secretName: ql3-cluster-control-runtime',
|
|
)
|
|
.replace('defaultMode: 288', 'defaultMode: 292'),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) =>
|
|
candidate.code ===
|
|
'QL3_CLUSTER_PLUGIN_RECOVERY_PRIVATE_REGISTRY_BINDING',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects runtime database authority in the Plugin Package recovery Job', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-recovery/base/recover-job.yaml',
|
|
(source) =>
|
|
source
|
|
.replace(
|
|
'name: QL3_POSTGRES_PACKAGE_EXECUTOR_URL',
|
|
'name: QL3_POSTGRES_RUNTIME_URL',
|
|
)
|
|
.replace(
|
|
'name: ql3-cluster-plugin-package-recovery\n key: postgres-package-executor-url',
|
|
'name: ql3-cluster-control-runtime\n key: postgres-runtime-url',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
(candidate) => candidate.code === 'QL3_CLUSTER_PLUGIN_RECOVERY_AUTHORITY',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects tag-based production overlays for either cluster image', () => {
|
|
for (const [relativePath, findingCode] of [
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg/kustomization.yaml',
|
|
'QL3_CLUSTER_CONTROL_RELEASE_DIGEST_PIN',
|
|
],
|
|
[
|
|
'deploy/kubernetes/ql3-cluster/operations/plugin-package-recovery/cloudnative-pg/kustomization.yaml',
|
|
'QL3_CLUSTER_ADMIN_RELEASE_DIGEST_PIN',
|
|
],
|
|
]) {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(relativePath, (source) =>
|
|
source.replace(/digest: sha256:0{64}/, `newTag: ${VERSION}`),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some((candidate) => candidate.code === findingCode),
|
|
true,
|
|
);
|
|
}
|
|
});
|
|
|
|
test('keeps Prompt output key retirement caller-driven and least privilege', () => {
|
|
const report = auditClusterDeployment({ root: ROOT });
|
|
assert.equal(report.compatible, true, JSON.stringify(report.findings));
|
|
assert.equal(report.promptOutputKeyRetirement, 'caller-driven-one-shot');
|
|
});
|
|
|
|
test('rejects widened Prompt output key retirement RBAC', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/prompt-output-key-retirement/base/role.yaml',
|
|
(source) =>
|
|
source.replace(' - update', ' - update\n - list'),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
({ code }) => code === 'QL3_CLUSTER_PROMPT_OUTPUT_KEY_RETIREMENT_RBAC',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects symlinked or broad Prompt output key retirement command mounts', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/prompt-output-key-retirement/base/job.yaml',
|
|
(source) => source.replace(' subPath: command.json\n', ''),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_PROMPT_OUTPUT_KEY_RETIREMENT_FILE_BOUNDARY',
|
|
),
|
|
true,
|
|
);
|
|
});
|
|
|
|
test('rejects an early or long-lived Prompt output key retirement token', () => {
|
|
const automaticToken = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/prompt-output-key-retirement/base/job.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' automountServiceAccountToken: false',
|
|
' automountServiceAccountToken: true',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(automaticToken.compatible, false);
|
|
assert.ok(
|
|
automaticToken.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_PROMPT_OUTPUT_KEY_RETIREMENT_LIFECYCLE',
|
|
),
|
|
);
|
|
|
|
const longLivedToken = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/prompt-output-key-retirement/base/job.yaml',
|
|
(source) =>
|
|
source.replace('expirationSeconds: 600', 'expirationSeconds: 3600'),
|
|
),
|
|
});
|
|
assert.equal(longLivedToken.compatible, false);
|
|
assert.ok(
|
|
longLivedToken.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_PROMPT_OUTPUT_KEY_RETIREMENT_FILE_BOUNDARY',
|
|
),
|
|
);
|
|
});
|
|
|
|
test('rejects public Prompt output key retirement egress', () => {
|
|
const report = auditClusterDeployment({
|
|
root: ROOT,
|
|
readFile: intercept(
|
|
'deploy/kubernetes/ql3-cluster/operations/prompt-output-key-retirement/base/network-policy.yaml',
|
|
(source) =>
|
|
source.replace(
|
|
' egress:\n',
|
|
' egress:\n - to:\n - ipBlock:\n cidr: 0.0.0.0/0\n',
|
|
),
|
|
),
|
|
});
|
|
assert.equal(report.compatible, false);
|
|
assert.equal(
|
|
report.findings.some(
|
|
({ code }) =>
|
|
code === 'QL3_CLUSTER_PROMPT_OUTPUT_KEY_RETIREMENT_NETWORK_POLICY',
|
|
),
|
|
true,
|
|
);
|
|
});
|