mirrors/pikasTech-agentrun
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: remove provider secret last-applied annotation (#94)

Browse Source 
Co-authored-by: Codex <codex@pikas.tech>
This commit is contained in:
Lyon
2026-06-05 19:04:59 +08:00
committed by GitHub
parent 46e3b771bb
commit 17e9cd3995
2 changed files with 34 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mgr/provider-profiles.ts
+12 -13
View File
@@ -12,6 +12,7 @@ import { runnerJobStatusSummary } from "./runner-job-status.js";
const defaultNamespace = "agentrun-v01";
const credentialAnnotationPrefix = "agentrun.pikastech.local/provider-profile";
const kubectlLastAppliedAnnotation = "kubectl.kubernetes.io/last-applied-configuration";
export interface ProviderProfileOptions {
namespace?: string;
@@ -71,7 +72,6 @@ export async function setProviderProfileCredential(profileValue: string, body: u
[`${credentialAnnotationPrefix}-credential-hash-suffix`]: shortHash(rendered.authJson),
[`${credentialAnnotationPrefix}-config-hash-suffix`]: shortHash(rendered.config.configToml),
[`${credentialAnnotationPrefix}-updated-at`]: new Date().toISOString(),
"kubectl.kubernetes.io/last-applied-configuration": null,
...(delegatedBy ? { [`${credentialAnnotationPrefix}-delegated-system`]: delegatedBy.system, [`${credentialAnnotationPrefix}-delegated-request-id`]: delegatedBy.requestId ?? "" } : {}),
},
},
@@ -81,7 +81,7 @@ export async function setProviderProfileCredential(profileValue: string, body: u
"config.toml": base64Data(rendered.config.configToml),
},
};
const applied = await kubectlReplaceOrCreateSecret(secretManifest, options.kubectlCommand ?? "kubectl");
const applied = await kubectlReplaceSecret(secretManifest, options.kubectlCommand ?? "kubectl");
return {
action: "provider-profile-credential-updated",
mutation: true,
@@ -423,22 +423,21 @@ async function kubectlGetSecret(name: string, namespace: string, kubectlCommand:
return parseKubectlObject(result.stdout, "secret");
}
async function kubectlReplaceOrCreateSecret(manifest: JsonRecord, kubectlCommand: string): Promise<JsonRecord> {
async function kubectlReplaceSecret(manifest: JsonRecord, kubectlCommand: string): Promise<JsonRecord> {
const name = stringPath(manifest, ["metadata", "name"]) ?? "<unknown>";
const namespace = stringPath(manifest, ["metadata", "namespace"]) ?? defaultNamespace;
const replace = await runKubectl(kubectlCommand, ["replace", "-f", "-", "-o", "json"], `${JSON.stringify(manifest)}\n`);
if (replace.code === 0) return parseKubectlObject(replace.stdout, "replaced secret", { redactSecretData: true });
if (replace.code === 0) return await kubectlRemoveLastAppliedAnnotation(kubectlCommand, name, namespace);
throw new AgentRunError("infra-failed", `kubectl replace provider profile secret ${namespace}/${name} failed with code ${replace.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(replace.stderr.slice(-2000)), stdout: redactText(replace.stdout.slice(-1000)) }) });
}
const replaceFailure = `${replace.stderr}\n${replace.stdout}`;
if (!/notfound|not found|not-found/iu.test(replaceFailure)) {
throw new AgentRunError("infra-failed", `kubectl replace provider profile secret ${namespace}/${name} failed with code ${replace.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(replace.stderr.slice(-2000)), stdout: redactText(replace.stdout.slice(-1000)) }) });
async function kubectlRemoveLastAppliedAnnotation(kubectlCommand: string, name: string, namespace: string): Promise<JsonRecord> {
const patch = { metadata: { annotations: { [kubectlLastAppliedAnnotation]: null } } };
const result = await runKubectl(kubectlCommand, ["patch", "secret", name, "-n", namespace, "--type", "merge", "-p", JSON.stringify(patch), "-o", "json"]);
if (result.code !== 0) {
throw new AgentRunError("infra-failed", `kubectl remove provider profile secret last-applied annotation ${namespace}/${name} failed with code ${result.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(result.stderr.slice(-2000)), stdout: redactText(result.stdout.slice(-1000)) }) });
}
const create = await runKubectl(kubectlCommand, ["create", "-f", "-", "-o", "json"], `${JSON.stringify(manifest)}\n`);
if (create.code !== 0) {
throw new AgentRunError("infra-failed", `kubectl create provider profile secret ${namespace}/${name} failed with code ${create.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(create.stderr.slice(-2000)), stdout: redactText(create.stdout.slice(-1000)) }) });
}
return parseKubectlObject(create.stdout, "created secret", { redactSecretData: true });
return parseKubectlObject(result.stdout, "provider profile secret annotation cleanup", { redactSecretData: true });
}
async function runKubectl(kubectlCommand: string, args: string[], stdin?: string): Promise<{ code: number | null; signal: NodeJS.Signals | null; stdout: string; stderr: string }> {