fix hwlab d601 global proxy git mirror wiring (#565)

Co-authored-by: Codex <codex@noreply.local>
2026-06-21 11:55:18 +08:00
parent b880842a31
commit 35fdaef944
3 changed files with 113 additions and 3 deletions
@@ -56,9 +56,13 @@ nodes:
      endpoint: 127.0.0.1:5000
    egressProxy:
      mode: k8s-service-cluster-ip
+      clientName: d601-global-proxy
      namespace: platform-infra
      serviceName: sub2api-egress-proxy
      port: 10808
+      sourceRef: platform-infra/master-vpn-subscription.env
+      sourceKey: MASTER_VPN_SUBSCRIPTION_URL
+      sourceType: subscription-url
      noProxy:
        - localhost
        - 127.0.0.1
@@ -109,6 +113,9 @@ targets:
      flushJobPrefix: git-mirror-hwlab-d601-v03-flush-manual
      readUrl: http://git-mirror-http.devops-infra.svc.cluster.local/pikasTech/HWLAB.git
      writeUrl: http://git-mirror-write.devops-infra.svc.cluster.local/pikasTech/HWLAB.git
+      egressProxy:
+        mode: node-global
+        required: true
    tekton:
      pipelineName: hwlab-d601-v03-ci-image-publish
      serviceAccountName: hwlab-d601-v03-tekton-runner
@@ -40,12 +40,21 @@ interface ArgoOptions {

 interface ControlPlaneEgressProxySpec {
  mode: "k8s-service-cluster-ip";
+  clientName: string;
  namespace: string;
  serviceName: string;
  port: number;
+  sourceRef: string;
+  sourceKey: string;
+  sourceType: "subscription-url";
  noProxy: readonly string[];
 }

+interface ControlPlaneGitMirrorEgressProxySpec {
+  mode: "node-global";
+  required: boolean;
+}
+
 interface ControlPlaneNodeSpec {
  id: string;
  route: string;
@@ -99,6 +108,7 @@ interface ControlPlaneTargetSpec {
    flushJobPrefix: string;
    readUrl: string;
    writeUrl: string;
+    egressProxy: ControlPlaneGitMirrorEgressProxySpec | null;
  };
  tekton: {
    pipelineName: string;
@@ -816,15 +826,30 @@ function execStartPreField(raw: unknown, path: string): readonly (readonly strin
 function egressProxySpec(raw: Record<string, unknown>, path: string): ControlPlaneEgressProxySpec {
  const mode = stringField(raw, "mode", path);
  if (mode !== "k8s-service-cluster-ip") throw new Error(`${path}.mode must be k8s-service-cluster-ip`);
+  const sourceType = stringField(raw, "sourceType", path);
+  if (sourceType !== "subscription-url") throw new Error(`${path}.sourceType must be subscription-url`);
  return {
    mode,
+    clientName: stringField(raw, "clientName", path),
    namespace: stringField(raw, "namespace", path),
    serviceName: stringField(raw, "serviceName", path),
    port: positiveConfigIntegerField(raw, "port", path),
+    sourceRef: stringField(raw, "sourceRef", path),
+    sourceKey: stringField(raw, "sourceKey", path),
+    sourceType,
    noProxy: stringArrayField(raw, "noProxy", path),
  };
 }

+function gitMirrorEgressProxySpec(raw: Record<string, unknown>, path: string): ControlPlaneGitMirrorEgressProxySpec {
+  const mode = stringField(raw, "mode", path);
+  if (mode !== "node-global") throw new Error(`${path}.mode must be node-global`);
+  return {
+    mode,
+    required: raw.required === undefined ? true : booleanField(raw, "required", path),
+  };
+}
+
 function targetSpec(raw: Record<string, unknown>, index: number): ControlPlaneTargetSpec {
  const path = `targets[${index}]`;
  const source = asRecord(raw.source, `${path}.source`);
@@ -838,6 +863,7 @@ function targetSpec(raw: Record<string, unknown>, index: number): ControlPlaneTa
  const gitMirrorNamespace = stringField(gitMirror, "namespace", `${path}.gitMirror`);
  const serviceReadName = stringField(gitMirror, "serviceReadName", `${path}.gitMirror`);
  const serviceWriteName = stringField(gitMirror, "serviceWriteName", `${path}.gitMirror`);
+  const gitMirrorEgressProxy = gitMirror.egressProxy === undefined ? null : gitMirrorEgressProxySpec(asRecord(gitMirror.egressProxy, `${path}.gitMirror.egressProxy`), `${path}.gitMirror.egressProxy`);
  const sourceRepository = stringField(source, "repository", `${path}.source`);
  return {
    id: stringField(raw, "id", path),
@@ -863,6 +889,7 @@ function targetSpec(raw: Record<string, unknown>, index: number): ControlPlaneTa
      flushJobPrefix: stringField(gitMirror, "flushJobPrefix", `${path}.gitMirror`),
      readUrl: optionalStringField(gitMirror, "readUrl", `${path}.gitMirror`) ?? `http://${serviceReadName}.${gitMirrorNamespace}.svc.cluster.local/${sourceRepository}.git`,
      writeUrl: optionalStringField(gitMirror, "writeUrl", `${path}.gitMirror`) ?? `http://${serviceWriteName}.${gitMirrorNamespace}.svc.cluster.local/${sourceRepository}.git`,
+      egressProxy: gitMirrorEgressProxy,
    },
    tekton: {
      pipelineName: stringField(tekton, "pipelineName", `${path}.tekton`),
@@ -1175,8 +1202,13 @@ NODE
 }

 function gitMirrorProxyPrelude(node: ControlPlaneNodeSpec, target: ControlPlaneTargetSpec): string {
-  const proxyHost = node.egressProxy?.serviceName === undefined ? "127.0.0.1" : `${node.egressProxy.serviceName}.${node.egressProxy.namespace}.svc.cluster.local`;
-  const proxyPort = node.egressProxy?.port ?? 10808;
+  if (target.gitMirror.egressProxy?.mode !== "node-global") throw new Error(`targets.${target.id}.gitMirror.egressProxy.mode must be node-global; git-mirror GitHub SSH no longer falls back to localhost`);
+  if (target.gitMirror.egressProxy.required && node.egressProxy === null) throw new Error(`nodes.${node.id}.egressProxy is required by targets.${target.id}.gitMirror.egressProxy`);
+  if (node.egressProxy === null) throw new Error(`nodes.${node.id}.egressProxy is missing; git-mirror GitHub SSH no longer falls back to localhost`);
+  const proxyHost = `${node.egressProxy.serviceName}.${node.egressProxy.namespace}.svc.cluster.local`;
+  const proxyPort = node.egressProxy.port;
+  const proxyUrl = `http://${proxyHost}:${proxyPort}`;
+  const noProxy = node.egressProxy.noProxy.join(",");
  return [
    "mkdir -p /root/.ssh",
    "cp /git-ssh/ssh-privatekey /root/.ssh/id_rsa",
@@ -1212,6 +1244,14 @@ function gitMirrorProxyPrelude(node: ControlPlaneNodeSpec, target: ControlPlaneT
    "socket.on('close', () => process.exit(0));",
    "NODE_PROXY",
    "chmod 0700 /tmp/hwlab-github-proxy-connect.cjs",
+    `export HTTP_PROXY=${shQuote(proxyUrl)}`,
+    `export HTTPS_PROXY=${shQuote(proxyUrl)}`,
+    `export ALL_PROXY=${shQuote(proxyUrl)}`,
+    `export http_proxy=${shQuote(proxyUrl)}`,
+    `export https_proxy=${shQuote(proxyUrl)}`,
+    `export all_proxy=${shQuote(proxyUrl)}`,
+    `export NO_PROXY=${shQuote(noProxy)}`,
+    `export no_proxy=${shQuote(noProxy)}`,
    `export GIT_SSH_COMMAND=${shQuote(`ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1 -o ProxyCommand='node /tmp/hwlab-github-proxy-connect.cjs ${proxyHost} ${proxyPort} %h %p'`)}`,
    `repository=${shQuote(target.source.repository)}`,
    `source_branch=${shQuote(target.source.branch)}`,
@@ -1411,6 +1451,7 @@ function expectedSummary(node: ControlPlaneNodeSpec, target: ControlPlaneTargetS
      servicePort: target.gitMirror.servicePort,
      deploymentReplicas: target.gitMirror.deploymentReplicas,
      syncConfigMap: target.gitMirror.syncConfigMapName,
+      egressProxy: target.gitMirror.egressProxy,
      statusSummaryKeys: ["localSource", "githubSource", "localGitops", "githubGitops", "pendingFlush", "flushNeeded", "githubInSync"],
    },
    pipeline: target.tekton.pipelineName,
@@ -239,12 +239,26 @@ interface NodeRuntimeGitMirrorTargetSpec {
  cachePvcName: string;
  cacheHostPath: string | null;
  secretName: string;
+  syncConfigMapName: string;
  syncJobPrefix: string;
  flushJobPrefix: string;
  toolsImage: string;
  sourceRepository: string;
  sourceBranch: string;
  gitopsBranch: string;
+  egressProxy: NodeRuntimeGitMirrorEgressProxySpec;
+}
+
+interface NodeRuntimeGitMirrorEgressProxySpec {
+  mode: "k8s-service-cluster-ip";
+  clientName: string;
+  namespace: string;
+  serviceName: string;
+  port: number;
+  sourceRef: string;
+  sourceKey: string;
+  sourceType: "subscription-url";
+  noProxy: string[];
 }

 const MASTER_ADMIN_API_KEY_KEY = "api-key";
@@ -3228,13 +3242,14 @@ function nodeRuntimeGitMirrorJobManifest(mirror: NodeRuntimeGitMirrorTargetSpec,
          volumes: [
            { name: "cache", ...(mirror.cacheHostPath === null ? { persistentVolumeClaim: { claimName: mirror.cachePvcName } } : { hostPath: { path: mirror.cacheHostPath, type: "DirectoryOrCreate" } }) },
            { name: "git-ssh", secret: { secretName: mirror.secretName, defaultMode: 0o400 } },
-            { name: "script", configMap: { name: "git-mirror-sync-script", defaultMode: 0o755 } },
+            { name: "script", configMap: { name: mirror.syncConfigMapName, defaultMode: 0o755 } },
          ],
          containers: [{
            name: action,
            image: mirror.toolsImage,
            imagePullPolicy: "IfNotPresent",
            command: [action === "sync" ? "/script/sync.sh" : "/script/flush.sh"],
+            env: nodeRuntimeGitMirrorProxyEnv(mirror),
            volumeMounts: [
              { name: "cache", mountPath: "/cache" },
              { name: "git-ssh", mountPath: "/git-ssh", readOnly: true },
@@ -3247,6 +3262,22 @@ function nodeRuntimeGitMirrorJobManifest(mirror: NodeRuntimeGitMirrorTargetSpec,
  };
 }

+function nodeRuntimeGitMirrorProxyEnv(mirror: NodeRuntimeGitMirrorTargetSpec): Record<string, string>[] {
+  const proxy = mirror.egressProxy;
+  const proxyUrl = `http://${proxy.serviceName}.${proxy.namespace}.svc.cluster.local:${proxy.port}`;
+  const noProxy = proxy.noProxy.join(",");
+  return [
+    { name: "HTTP_PROXY", value: proxyUrl },
+    { name: "HTTPS_PROXY", value: proxyUrl },
+    { name: "ALL_PROXY", value: proxyUrl },
+    { name: "http_proxy", value: proxyUrl },
+    { name: "https_proxy", value: proxyUrl },
+    { name: "all_proxy", value: proxyUrl },
+    { name: "NO_PROXY", value: noProxy },
+    { name: "no_proxy", value: noProxy },
+  ];
+}
+
 function nodeRuntimeControlPlaneStatus(scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>): Record<string, unknown> {
  const spec = scoped.spec;
  const sourceCommitOverride = optionValue(scoped.originalArgs, "--source-commit");
@@ -5831,10 +5862,16 @@ function externalPostgresSecretStatus(spec: HwlabRuntimeLaneSpec, namespaceExist
 function nodeRuntimeGitMirrorTarget(spec: HwlabRuntimeLaneSpec): NodeRuntimeGitMirrorTargetSpec {
  const configPath = rootPath(HWLAB_NODE_CONTROL_PLANE_CONFIG_PATH);
  const parsed = record(Bun.YAML.parse(readFileSync(configPath, "utf8")) as unknown);
+  const nodes = record(parsed.nodes);
+  const node = record(nodes[spec.nodeId]);
+  const nodeEgressProxy = nodeRuntimeGitMirrorEgressProxySpec(record(node.egressProxy), `nodes.${spec.nodeId}.egressProxy`);
  const targets = Array.isArray(parsed.targets) ? parsed.targets : [];
  const target = targets.map((item) => record(item)).find((item) => item.node === spec.nodeId && item.lane === spec.lane);
  if (target === undefined) throw new Error(`no gitMirror target for node=${spec.nodeId} lane=${spec.lane} in ${HWLAB_NODE_CONTROL_PLANE_CONFIG_PATH}`);
  const gitMirror = record(target.gitMirror);
+  const gitMirrorEgressProxy = record(gitMirror.egressProxy);
+  if (stringValue(gitMirrorEgressProxy.mode, "gitMirror.egressProxy.mode") !== "node-global") throw new Error(`gitMirror.egressProxy.mode must be node-global for node=${spec.nodeId} lane=${spec.lane}`);
+  if (gitMirrorEgressProxy.required !== true) throw new Error(`gitMirror.egressProxy.required must be true for node=${spec.nodeId} lane=${spec.lane}`);
  const source = record(target.source);
  const gitops = record(target.gitops);
  const tekton = record(target.tekton);
@@ -5849,12 +5886,37 @@ function nodeRuntimeGitMirrorTarget(spec: HwlabRuntimeLaneSpec): NodeRuntimeGitM
    cachePvcName: stringValue(gitMirror.cachePvcName, "gitMirror.cachePvcName"),
    cacheHostPath: optionalStringValue(gitMirror.cacheHostPath, "gitMirror.cacheHostPath"),
    secretName: stringValue(gitMirror.secretName, "gitMirror.secretName"),
+    syncConfigMapName: stringValue(gitMirror.syncConfigMapName, "gitMirror.syncConfigMapName"),
    syncJobPrefix: stringValue(gitMirror.syncJobPrefix, "gitMirror.syncJobPrefix"),
    flushJobPrefix: stringValue(gitMirror.flushJobPrefix, "gitMirror.flushJobPrefix"),
    toolsImage: stringValue(toolsImage.output, "tekton.toolsImage.output"),
    sourceRepository: stringValue(source.repository, "source.repository"),
    sourceBranch: stringValue(source.branch, "source.branch"),
    gitopsBranch: stringValue(gitops.branch, "gitops.branch"),
+    egressProxy: nodeEgressProxy,
+  };
+}
+
+function nodeRuntimeGitMirrorEgressProxySpec(raw: Record<string, unknown>, path: string): NodeRuntimeGitMirrorEgressProxySpec {
+  const mode = stringValue(raw.mode, `${path}.mode`);
+  if (mode !== "k8s-service-cluster-ip") throw new Error(`${path}.mode must be k8s-service-cluster-ip`);
+  const port = Number(raw.port);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`${path}.port must be a TCP port`);
+  const sourceType = stringValue(raw.sourceType, `${path}.sourceType`);
+  if (sourceType !== "subscription-url") throw new Error(`${path}.sourceType must be subscription-url`);
+  const noProxyRaw = raw.noProxy;
+  if (!Array.isArray(noProxyRaw)) throw new Error(`${path}.noProxy must be an array`);
+  const noProxy = noProxyRaw.map((item, index) => stringValue(item, `${path}.noProxy[${index}]`));
+  return {
+    mode,
+    clientName: stringValue(raw.clientName, `${path}.clientName`),
+    namespace: stringValue(raw.namespace, `${path}.namespace`),
+    serviceName: stringValue(raw.serviceName, `${path}.serviceName`),
+    port,
+    sourceRef: stringValue(raw.sourceRef, `${path}.sourceRef`),
+    sourceKey: stringValue(raw.sourceKey, `${path}.sourceKey`),
+    sourceType,
+    noProxy,
  };
 }