diff --git a/config/fixtures/pikaoa-observability-invalid-label.yaml b/config/fixtures/pikaoa-observability-invalid-label.yaml new file mode 100644 index 00000000..3da4cab1 --- /dev/null +++ b/config/fixtures/pikaoa-observability-invalid-label.yaml @@ -0,0 +1,5 @@ +metricsBackend: + discovery: + labelSelector: + key: invalid label key + value: "true" diff --git a/config/fixtures/pikaoa-test-target.yaml b/config/fixtures/pikaoa-test-target.yaml index 9b17b945..37b81d12 100644 --- a/config/fixtures/pikaoa-test-target.yaml +++ b/config/fixtures/pikaoa-test-target.yaml @@ -97,8 +97,9 @@ testRuntime: hostIP: 192.0.2.10 port: 32080 observability: - otlpEndpoint: http://otel-collector.observability.svc.cluster.local:4318 + otlpEndpoint: otel-collector.observability.svc.cluster.local:4317 prometheus: + configRef: config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector scrape: true apiPath: /metrics workerPath: /metrics diff --git a/config/pikaoa.yaml b/config/pikaoa.yaml index e3a4a12a..78698329 100644 --- a/config/pikaoa.yaml +++ b/config/pikaoa.yaml @@ -117,8 +117,9 @@ testRuntime: port: 32080 observability: configRef: config/platform-infra/observability.yaml - otlpEndpoint: http://otel-collector.platform-infra.svc.cluster.local:4318 + otlpEndpoint: otel-collector.platform-infra.svc.cluster.local:4317 prometheus: + configRef: config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector scrape: true apiPath: /metrics workerPath: /metrics @@ -228,7 +229,7 @@ delivery: configRef: config/platform-db/postgres-pk01.yaml#exports.connectionStrings.pikaoa-database-url observability: configRef: config/platform-infra/observability.yaml - otlpHttpEndpoint: http://otel-collector.platform-infra.svc.cluster.local:4318 + otlpEndpoint: otel-collector.platform-infra.svc.cluster.local:4317 prometheusScrape: true propagation: - tracecontext diff --git a/docs/MDTODO/details/pikaoa-enterprise-platform/R1.5.9.10_Task_Report.md b/docs/MDTODO/details/pikaoa-enterprise-platform/R1.5.9.10_Task_Report.md new file mode 100644 index 00000000..a0ada990 --- /dev/null +++ b/docs/MDTODO/details/pikaoa-enterprise-platform/R1.5.9.10_Task_Report.md @@ -0,0 +1,41 @@ +# R1.5.9.10 任务报告 + +## 状态 + +- 当前状态：`in_progress`。 +- 关联 issue：`pikasTech/unidesk#2092`。 +- 实现分支：`fix/pikaoa-observability`。 +- 本阶段仅完成源码、owning YAML、fixture 和定向验证；未执行任何运行面 mutation，未启动 Prometheus、Collector、Tempo 或 PikaOA Pod。 +- 后续仍需主代理通过受控 observability apply 完成 NC01 trace/metrics 原入口验收后再决定完成状态。 + +## 实现 + +- `config/pikaoa.yaml`： + - 测试与生产 `otlpEndpoint` 统一为无 scheme 的 OTLP gRPC endpoint `otel-collector.platform-infra.svc.cluster.local:4317`； + - 删除生产旧字段 `otlpHttpEndpoint`，不保留兼容入口； + - 测试 Prometheus 新增 `configRef`，指向 `config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector`。 +- `scripts/src/pikaoa-test-target.ts`： + - 复用共享 `scripts/src/ops/config-refs.ts` 的 `resolveConfigRef`； + - 校验 configRef、OTLP gRPC endpoint 及 Kubernetes label key/value； + - 将 selector label 加入 API/Worker Pod template，Web 不添加； + - 在 plan/status 投影 selector 的 `sourceRef`、`presence`、`fingerprint` 和 `valuesPrinted=false`； + - selector 漂移与 OTel exporter 失败均保持 `blocking=false` warning，不阻塞业务 MVP。 +- fixture 与测试： + - 更新 endpoint 与 selector configRef； + - 增加非法 label fixture； + - 覆盖 endpoint、API/Worker selector label、Web 无 selector、configRef 缺失、引用路径错误、非法 Kubernetes label、旧生产字段删除及 `valuesPrinted=false`。 + +## 验证 + +- `bun --check scripts/src/pikaoa-test-target.ts`：通过。 +- `bun test scripts/src/pikaoa-test-target-async.test.ts`：`2 pass, 0 fail`。 +- `bun scripts/cli.ts check --syntax-only`：`11 passed, 0 failed`。 +- `bun scripts/cli.ts pikaoa test-target plan ...` compact text：通过，`mutation=false`、`valuesPrinted=false`；clean Artificer workspace 缺 fixture Secret 时仅显示既有非变更 blocker，不读取或打印 Secret，也不作为本任务运行面门禁。 +- `git diff --check`：通过。 +- `scripts/src/pikaoa-test-target.ts`：1910 行，低于 2000 行。 + +## 边界与后续 + +- 用户确认开发初期旧数据可丢；本任务不实现旧数据迁移、兼容或回滚，现有 migration 命名仅表示全新数据库初始化。 +- Prometheus 当前未 apply/ready 不阻塞业务 MVP；后续由主代理按受控入口完成 apply、Tempo trace 和 Prometheus metrics 验收。 +- 本报告回链 MDTODO `R1.5.9.10`，任务保持进行中。 diff --git a/scripts/src/pikaoa-test-target-async.test.ts b/scripts/src/pikaoa-test-target-async.test.ts index e2e4e34c..61ad054c 100644 --- a/scripts/src/pikaoa-test-target-async.test.ts +++ b/scripts/src/pikaoa-test-target-async.test.ts @@ -162,13 +162,15 @@ exit 64 return JSON.parse(result.renderedText) as Record; }; const waitFor = async (instance: string, expectedCode: string, step = "all"): Promise> => { + let lastStatus: Record | null = null; for (let attempt = 0; attempt < 80; attempt += 1) { const value = await projection("status", instance, false, step); const status = value.status as Record; if (status.code === expectedCode) return value; + lastStatus = status; await Bun.sleep(25); } - assert.fail(`status did not reach ${expectedCode}`); + assert.fail(`status did not reach ${expectedCode}: ${JSON.stringify(lastStatus)}`); }; try { @@ -178,9 +180,21 @@ exit 64 const sources = secret.sources as Array>; assert.equal(sources.find((source) => source.purpose === "database.connection")?.presence, true); const objects = plan.objects as Array>; + const observability = plan.observability as Record; + const prometheus = observability.prometheus as Record; + const selector = prometheus.selector as Record; assert.equal(objects.some((object) => object.kind === "StatefulSet" || object.name === "pikaoa-postgres"), false); assert.equal(objects.some((object) => object.kind === "Deployment" && object.name === "pikaoa-web"), true); assert.equal(objects.find((object) => object.kind === "Deployment" && object.name === "pikaoa-api")?.podFsGroup, 65532); + assert.equal(observability.otlpEndpoint, "otel-collector.observability.svc.cluster.local:4317"); + assert.equal(selector.sourceRef, "config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector"); + assert.equal(selector.presence, true); + assert.match(String(selector.fingerprint), /^sha256:[0-9a-f]{64}$/u); + assert.equal(selector.valuesPrinted, false); + for (const component of ["pikaoa-api", "pikaoa-worker"]) { + assert.equal(objects.find((object) => object.kind === "Deployment" && object.name === component)?.prometheusSelectorLabel, selector.value); + } + assert.equal(objects.find((object) => object.kind === "Deployment" && object.name === "pikaoa-web")?.prometheusSelectorLabel, undefined); assert.deepEqual(plan.exposure, { serviceType: "NodePort", serviceName: "pikaoa-web", hostIP: "192.0.2.10", port: 32080 }); assert.deepEqual(plan.webApiUpstream, { envName: "PIKAOA_API_UPSTREAM", value: "http://pikaoa-api:8080", scope: "same-namespace" }); @@ -387,6 +401,7 @@ test("validation-only fixture never invokes remote capture", async () => { valuesPrinted: false, }); assert.equal(planPayload.valuesPrinted, false); + assert.equal(((planPayload.observability as Record).prometheus as Record).selector !== undefined, true); assert.equal(JSON.stringify(planPayload).includes("fixture-db-password"), false); assert.equal(JSON.stringify(planPayload).includes("postgres://"), false); @@ -407,6 +422,54 @@ test("validation-only fixture never invokes remote capture", async () => { rmSync(missingSchemaRoot, { recursive: true, force: true }); } + const missingSelectorRoot = mkdtempSync(join(tmpdir(), "pikaoa-test-target-missing-selector-")); + const missingSelectorPath = join(missingSelectorRoot, "pikaoa.yaml"); + const fixture = readFileSync(rootPath("config", "fixtures", "pikaoa-test-target.yaml"), "utf8"); + writeFileSync(missingSelectorPath, fixture.replace(" configRef: config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector\n", "")); + try { + await assert.rejects( + runPikaoaCommand({} as UniDeskConfig, ["test-target", "status", "--config", missingSelectorPath, "--target", "TEST01", "--instance", "missing-selector", "--output", "json"], forbiddenCapture), + /observability\.prometheus\.configRef 必须是非空字符串/u, + ); + } finally { + rmSync(missingSelectorRoot, { recursive: true, force: true }); + } + + const invalidSelectorRoot = mkdtempSync(join(tmpdir(), "pikaoa-test-target-invalid-selector-")); + const invalidSelectorPath = join(invalidSelectorRoot, "pikaoa.yaml"); + writeFileSync(invalidSelectorPath, fixture.replace( + "config/platform-infra/observability.yaml#metricsBackend.discovery.labelSelector", + "config/fixtures/pikaoa-observability-invalid-label.yaml#metricsBackend.discovery.labelSelector", + )); + try { + await assert.rejects( + runPikaoaCommand({} as UniDeskConfig, ["test-target", "status", "--config", invalidSelectorPath, "--target", "TEST01", "--instance", "invalid-selector", "--output", "json"], forbiddenCapture), + /observability\.prometheus\.configRef\.key 必须是合法 Kubernetes label key/u, + ); + } finally { + rmSync(invalidSelectorRoot, { recursive: true, force: true }); + } + + const missingSelectorPathRoot = mkdtempSync(join(tmpdir(), "pikaoa-test-target-missing-selector-path-")); + const missingSelectorConfigPath = join(missingSelectorPathRoot, "pikaoa.yaml"); + writeFileSync(missingSelectorConfigPath, fixture.replace("metricsBackend.discovery.labelSelector", "metricsBackend.discovery.missingSelector")); + try { + await assert.rejects( + runPikaoaCommand({} as UniDeskConfig, ["test-target", "status", "--config", missingSelectorConfigPath, "--target", "TEST01", "--instance", "missing-selector-path", "--output", "json"], forbiddenCapture), + /observability\.prometheus\.configRef 解析失败.*missingSelector/u, + ); + } finally { + rmSync(missingSelectorPathRoot, { recursive: true, force: true }); + } + + const owningConfig = Bun.YAML.parse(readFileSync(rootPath("config", "pikaoa.yaml"), "utf8")) as Record; + const testTarget = (((owningConfig.testRuntime as Record).targets as Record).NC01 as Record); + assert.equal((testTarget.observability as Record).otlpEndpoint, "otel-collector.platform-infra.svc.cluster.local:4317"); + const production = (((owningConfig.delivery as Record).targets as Record).NC01 as Record); + const productionObservability = (production.runtime as Record).observability as Record; + assert.equal(productionObservability.otlpEndpoint, "otel-collector.platform-infra.svc.cluster.local:4317"); + assert.equal("otlpHttpEndpoint" in productionObservability, false); + const unconfiguredRoot = mkdtempSync(join(tmpdir(), "pikaoa-test-target-unconfigured-")); const unconfiguredPath = join(unconfiguredRoot, "pikaoa.yaml"); writeFileSync(unconfiguredPath, "version: 1\nkind: pikaoa-platform-delivery\ntestRuntime:\n defaultTargetId: null\n targets: {}\n"); diff --git a/scripts/src/pikaoa-test-target.ts b/scripts/src/pikaoa-test-target.ts index 37a33861..1ea5c84d 100644 --- a/scripts/src/pikaoa-test-target.ts +++ b/scripts/src/pikaoa-test-target.ts @@ -9,6 +9,7 @@ import { renderMachine } from "./cicd-render"; import type { RenderedCliResult } from "./output"; import { CliInputError } from "./output"; import { capture, compactCapture, parseJsonOutput, readYamlRecord, sha256Fingerprint, shQuote } from "./platform-infra-ops-library"; +import { resolveConfigRef } from "./ops/config-refs"; type TestTargetAction = "plan" | "status" | "start" | "stop"; type TestTargetStep = "all" | "foundation" | "migration" | "api" | "worker" | "web"; @@ -31,6 +32,15 @@ interface SecretSourceSpec { targetKey: string; } +interface PrometheusSelectorSpec { + sourceRef: string; + key: string; + value: string; + presence: true; + fingerprint: string; + valuesPrinted: false; +} + interface TestTargetSpec { id: string; enabled: boolean; @@ -107,6 +117,7 @@ interface TestTargetSpec { observability: { otlpEndpoint: string; prometheusScrape: boolean; + prometheusSelector: PrometheusSelectorSpec; apiMetricsPath: string; workerMetricsPath: string; exporterWarning: boolean; @@ -387,8 +398,9 @@ function parseTarget(id: string, root: Record, configLabel: str port: positiveInteger(exposure.port, `${path}.exposure.port`, 65_535), }, observability: { - otlpEndpoint: nonEmpty(observability.otlpEndpoint, `${path}.observability.otlpEndpoint`), + otlpEndpoint: otlpGrpcEndpoint(observability.otlpEndpoint, `${path}.observability.otlpEndpoint`), prometheusScrape: boolean(prometheus.scrape, `${path}.observability.prometheus.scrape`), + prometheusSelector: prometheusSelector(prometheus.configRef, `${path}.observability.prometheus`), apiMetricsPath: httpPath(prometheus.apiPath, `${path}.observability.prometheus.apiPath`), workerMetricsPath: httpPath(prometheus.workerPath, `${path}.observability.prometheus.workerPath`), exporterWarning: boolean(exporterFailure.warning, `${path}.observability.exporterFailure.warning`), @@ -439,6 +451,7 @@ function planPayload(options: TestTargetOptions, selection: Selection): Record objectSummary(object, target.observability.prometheusSelector.key)), selectors, secret: { name: target.runtime.secretName, @@ -504,8 +517,7 @@ function renderedPlan(selection: Selection, context: RenderContext): Record { + return { + otlpEndpoint: target.observability.otlpEndpoint, + prometheus: { + scrape: target.observability.prometheusScrape, + selector: target.observability.prometheusSelector, + }, + valuesPrinted: false, + }; +} + +function prometheusRuntimeStatus(items: Record[], selector: PrometheusSelectorSpec, runtimePresent: boolean, step: TestTargetStep): Record { + const components = step === "all" ? ["api", "worker"] : step === "api" || step === "worker" ? [step] : []; + const workloads = components.map((component) => { + const deployment = items.find((item) => item.kind === "Deployment" && optionalRecord(item.metadata, "resource.metadata")?.name === `pikaoa-${component}`); + const spec = deployment === undefined ? null : optionalRecord(deployment.spec, "resource.spec"); + const template = spec === null ? null : optionalRecord(spec.template, "resource.spec.template"); + const metadata = template === null ? null : optionalRecord(template.metadata, "resource.spec.template.metadata"); + const labels = metadata === null ? null : optionalRecord(metadata.labels, "resource.spec.template.metadata.labels"); + const actual = labels?.[selector.key]; + return { component, present: deployment !== undefined, actual: typeof actual === "string" ? actual : null, matches: actual === selector.value }; + }); + const checked = runtimePresent && components.length > 0; + const drift = checked && workloads.some((workload) => !workload.matches); + return { + selector, + checked, + workloads, + drift, + warning: drift ? warning("prometheus-selector-label-drift", "API/Worker Pod template 的 Prometheus selector label 与 owning configRef 不一致；该漂移不阻塞业务运行。") : null, + blocking: false, + valuesPrinted: false, + }; +} + function buildManifest(target: TestTargetSpec, context: RenderContext, secrets: SecretMaterial): Record[] { const labels = ownershipLabels(target, context); const secretData = runtimeSecretData(target, context, secrets); @@ -677,6 +724,9 @@ function buildManifest(target: TestTargetSpec, context: RenderContext, secrets: const workerSelector = componentSelector("worker", context.instanceId); const webSelector = componentSelector("web", context.instanceId); const migrationSelector = componentSelector("migration", context.instanceId); + const prometheusPodLabels = target.observability.prometheusScrape ? { + [target.observability.prometheusSelector.key]: target.observability.prometheusSelector.value, + } : {}; const commonPodAnnotations = (path: string, port: number): Record => target.observability.prometheusScrape ? { "prometheus.io/scrape": "true", "prometheus.io/path": path, @@ -728,7 +778,7 @@ function buildManifest(target: TestTargetSpec, context: RenderContext, secrets: }, }, }, - deployment(target, context, "api", context.apiImage, apiSelector, target.runtime.apiPort, commonPodAnnotations(target.observability.apiMetricsPath, target.runtime.apiPort), [ + deployment(target, context, "api", context.apiImage, apiSelector, target.runtime.apiPort, prometheusPodLabels, commonPodAnnotations(target.observability.apiMetricsPath, target.runtime.apiPort), [ { name: "PIKAOA_CONFIG", value: "/etc/pikaoa/pikaoa.yaml" }, { name: "PIKAOA_SESSION_SECRET", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.sessionSecret.targetKey } } }, { name: "PIKAOA_BOOTSTRAP_ADMIN_USERNAME", value: target.runtime.administrator.username }, @@ -736,10 +786,10 @@ function buildManifest(target: TestTargetSpec, context: RenderContext, secrets: { name: "PIKAOA_BOOTSTRAP_EMPLOYEE_USERNAME", value: target.runtime.employee.username }, { name: "PIKAOA_BOOTSTRAP_EMPLOYEE_PASSWORD", valueFrom: { secretKeyRef: { name: target.runtime.secretName, key: target.runtime.employee.password.targetKey } } }, ], target.probes.apiLivenessPath, target.probes.apiReadinessPath), - deployment(target, context, "worker", context.workerImage, workerSelector, target.runtime.workerMetricsPort, commonPodAnnotations(target.observability.workerMetricsPath, target.runtime.workerMetricsPort), [ + deployment(target, context, "worker", context.workerImage, workerSelector, target.runtime.workerMetricsPort, prometheusPodLabels, commonPodAnnotations(target.observability.workerMetricsPath, target.runtime.workerMetricsPort), [ { name: "PIKAOA_CONFIG", value: "/etc/pikaoa/pikaoa.yaml" }, ], target.probes.workerLivenessPath, target.probes.workerReadinessPath), - deployment(target, context, "web", context.webImage, webSelector, target.runtime.webPort, {}, [ + deployment(target, context, "web", context.webImage, webSelector, target.runtime.webPort, {}, {}, [ { name: target.runtime.webApiUpstreamEnv, value: `http://${target.runtime.apiServiceName}:${target.runtime.apiPort}` }, ], target.probes.webLivenessPath, target.probes.webReadinessPath), ]; @@ -765,6 +815,7 @@ function deployment( image: string, selector: Record, port: number, + podLabels: Record, annotations: Record, env: Array>, livenessPath: string, @@ -776,7 +827,7 @@ function deployment( spec: { replicas: 1, selector: { matchLabels: selector }, template: { - metadata: { labels: { ...labels, ...selector }, annotations }, + metadata: { labels: { ...labels, ...selector, ...podLabels }, annotations }, spec: { ...(component === "api" ? { securityContext: { fsGroup: target.runtime.attachment.fsGroup } } : {}), containers: [{ @@ -1419,6 +1470,7 @@ function summarizeRemoteStatus(parsed: Record, target: TestTarg const labels = optionalRecord(metadata.labels, "status.namespace.metadata.labels") ?? {}; const resources = optionalRecord(runtime.resources, "status.runtime.resources") ?? {}; const items = Array.isArray(resources.items) ? resources.items.filter(isRecord) : []; + const prometheus = prometheusRuntimeStatus(items, target.observability.prometheusSelector, runtime.exists === true, context.step); return { ok: parsed.ok === true, code: parsed.code ?? "start-status-unknown", @@ -1453,7 +1505,7 @@ function summarizeRemoteStatus(parsed: Record, target: TestTarg }), database: { external: true, configRef: target.database.configRef, ...secretSourceSummary(configPath, target.database.connection) }, exposure: { hostIP: target.exposure.hostIP, port: target.exposure.port, serviceName: target.exposure.serviceName }, - observability: { otlpEndpoint: target.observability.otlpEndpoint, prometheusScrape: target.observability.prometheusScrape, blocking: false }, + observability: { ...observabilitySummary(target), prometheus, blocking: false }, }, valuesPrinted: false, }; @@ -1566,17 +1618,20 @@ function namespaceAnnotations(target: TestTargetSpec, context: RenderContext): R }; } -function objectSummary(object: Record): Record { +function objectSummary(object: Record, prometheusSelectorKey: string): Record { const metadata = optionalRecord(object.metadata, "metadata") ?? {}; const labels = optionalRecord(metadata.labels, "metadata.labels") ?? {}; const spec = optionalRecord(object.spec, "spec") ?? {}; const template = optionalRecord(spec.template, "spec.template") ?? {}; + const templateMetadata = optionalRecord(template.metadata, "spec.template.metadata") ?? {}; + const podLabels = optionalRecord(templateMetadata.labels, "spec.template.metadata.labels") ?? {}; const podSpec = optionalRecord(template.spec, "spec.template.spec") ?? {}; const securityContext = optionalRecord(podSpec.securityContext, "spec.template.spec.securityContext") ?? {}; return { kind: object.kind ?? null, name: metadata.name ?? null, owned: labels["app.kubernetes.io/managed-by"] === MANAGED_BY && labels[TEST_RUNTIME_LABEL] === "true" && typeof labels[TARGET_LABEL] === "string" && typeof labels[INSTANCE_LABEL] === "string", + prometheusSelectorLabel: object.kind === "Deployment" && typeof podLabels[prometheusSelectorKey] === "string" ? podLabels[prometheusSelectorKey] : undefined, podFsGroup: securityContext.fsGroup, secretValuesRedacted: object.kind === "Secret" ? true : undefined, }; @@ -1705,6 +1760,43 @@ function imageReference(value: unknown, path: string): string { return image; } +function otlpGrpcEndpoint(value: unknown, path: string): string { + const endpoint = nonEmpty(value, path); + if (endpoint.includes("://") || !/^[A-Za-z0-9.-]+:[1-9][0-9]{0,4}$/u.test(endpoint)) throw new Error(`${path} 必须是无 scheme 的 OTLP gRPC host:port`); + const port = Number(endpoint.slice(endpoint.lastIndexOf(":") + 1)); + if (port > 65_535) throw new Error(`${path} 端口必须是 1-65535`); + return endpoint; +} + +function prometheusSelector(value: unknown, path: string): PrometheusSelectorSpec { + const sourceRef = nonEmpty(value, `${path}.configRef`); + let resolved: ReturnType; + try { + resolved = resolveConfigRef(sourceRef, `${path}.configRef`); + } catch (error) { + throw new Error(`${path}.configRef 解析失败：${error instanceof Error ? error.message : String(error)}`); + } + const selector = record(resolved.value, `${path}.configRef (${sourceRef})`); + const key = kubernetesLabelKey(nonEmpty(selector.key, `${path}.configRef.key`), `${path}.configRef.key`); + const selectorValue = kubernetesLabelValue(nonEmpty(selector.value, `${path}.configRef.value`), `${path}.configRef.value`); + return { sourceRef, key, value: selectorValue, presence: true, fingerprint: `sha256:${resolved.sha256}`, valuesPrinted: false }; +} + +function kubernetesLabelKey(value: string, path: string): string { + const parts = value.split("/"); + const name = parts.pop() ?? ""; + const prefix = parts.length === 1 ? parts[0] : null; + const labelNamePattern = /^[A-Za-z0-9](?:[A-Za-z0-9_.-]{0,61}[A-Za-z0-9])?$/u; + const dnsPrefixPattern = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/u; + if (parts.length > 1 || !labelNamePattern.test(name) || (prefix !== null && !dnsPrefixPattern.test(prefix))) throw new Error(`${path} 必须是合法 Kubernetes label key`); + return value; +} + +function kubernetesLabelValue(value: string, path: string): string { + if (!/^[A-Za-z0-9](?:[A-Za-z0-9_.-]{0,61}[A-Za-z0-9])?$/u.test(value)) throw new Error(`${path} 必须是合法 Kubernetes label value`); + return value; +} + function postgresIdentifier(value: unknown, path: string): string { const name = nonEmpty(value, path); if (!/^[a-z_][a-z0-9_]{0,62}$/u.test(name)) throw new Error(`${path} 必须是简单 PostgreSQL identifier`);