mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix secret-plane validate stdin and consumer restart

Browse Source
This commit is contained in:
Codex
2026-06-27 09:08:29 +00:00
parent 1881003696
commit 44a679ab2e
1 changed files with 29 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/src/platform-infra-secret-plane.ts
+29 -9
View File
@@ -926,7 +926,7 @@ printf '%s' ${shQuote(testValue)} >"$expected"
vault_pod="$(kubectl -n ${target.namespace} get pod -l app.kubernetes.io/name=${secretPlane.vault.deploymentName},app.kubernetes.io/component=vault-backend -o jsonpath='{.items[0].metadata.name}' 2>"$tmp/vault-pod.err" || true)"
printf '%s' "$vault_pod" >"$tmp/vault-pod.txt"
if [ -n "$vault_pod" ]; then
kubectl -n ${target.namespace} exec "$vault_pod" -- sh -lc ${shQuote(vaultPutCommand)} <"$expected" >"$tmp/vault-put.out" 2>"$tmp/vault-put.err"
kubectl -n ${target.namespace} exec -i "$vault_pod" -- sh -lc ${shQuote(vaultPutCommand)} <"$expected" >"$tmp/vault-put.out" 2>"$tmp/vault-put.err"
vault_put_rc=$?
kubectl -n ${target.namespace} exec "$vault_pod" -- sh -lc ${shQuote(vaultMetadataCommand)} >"$tmp/vault-metadata.out" 2>"$tmp/vault-metadata.err"
vault_metadata_rc=$?
@@ -951,24 +951,40 @@ while [ "$(date +%s)" -le "$deadline" ]; do
fi
sleep ${secretPlane.validation.pollSeconds}
done
if [ "$sync_rc" -eq 0 ]; then
kubectl -n ${target.namespace} rollout restart deployment/${secretPlane.syncProbe.consumer.deploymentName} >"$tmp/consumer-rollout-restart.out" 2>"$tmp/consumer-rollout-restart.err"
consumer_rollout_restart_rc=$?
if [ "$consumer_rollout_restart_rc" -eq 0 ]; then
kubectl -n ${target.namespace} rollout status deployment/${secretPlane.syncProbe.consumer.deploymentName} --timeout=25s >"$tmp/consumer-rollout.out" 2>"$tmp/consumer-rollout.err"
consumer_rollout_rc=$?
else
consumer_rollout_rc=1
printf '%s\\n' 'consumer rollout restart failed' >"$tmp/consumer-rollout.err"
fi
else
consumer_rollout_restart_rc=1
consumer_rollout_rc=1
printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-rollout-restart.err"
printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-rollout.err"
fi
consumer_pod="$(kubectl -n ${target.namespace} get pod -l app.kubernetes.io/name=${secretPlane.syncProbe.consumer.deploymentName},app.kubernetes.io/component=secret-consumer -o jsonpath='{.items[0].metadata.name}' 2>"$tmp/consumer-pod.err" || true)"
printf '%s' "$consumer_pod" >"$tmp/consumer-pod.txt"
if [ "$sync_rc" -eq 0 ] && [ -n "$consumer_pod" ]; then
kubectl -n ${target.namespace} exec "$consumer_pod" -- sh -lc ${shQuote(consumerCommand)} <"$expected" >"$tmp/consumer-env.out" 2>"$tmp/consumer-env.err"
if [ "$sync_rc" -eq 0 ] && [ "$consumer_rollout_rc" -eq 0 ] && [ -n "$consumer_pod" ]; then
kubectl -n ${target.namespace} exec -i "$consumer_pod" -- sh -lc ${shQuote(consumerCommand)} <"$expected" >"$tmp/consumer-env.out" 2>"$tmp/consumer-env.err"
consumer_env_rc=$?
else
consumer_env_rc=1
if [ -z "$consumer_pod" ]; then printf '%s\\n' 'consumer pod not found' >"$tmp/consumer-env.err"; else printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-env.err"; fi
if [ -z "$consumer_pod" ]; then printf '%s\\n' 'consumer pod not found' >"$tmp/consumer-env.err"; elif [ "$consumer_rollout_rc" -ne 0 ]; then printf '%s\\n' 'consumer rollout not ready' >"$tmp/consumer-env.err"; else printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-env.err"; fi
fi
kubectl -n ${target.namespace} get secretstore ${secretPlane.syncProbe.secretStoreName} -o json >"$tmp/secretstore.json" 2>"$tmp/secretstore.err"
secretstore_rc=$?
kubectl -n ${target.namespace} get externalsecret ${secretPlane.syncProbe.externalSecretName} -o json >"$tmp/externalsecret.json" 2>"$tmp/externalsecret.err"
externalsecret_rc=$?
python3 - "$vault_put_rc" "$vault_metadata_rc" "$sync_rc" "$consumer_env_rc" "$secretstore_rc" "$externalsecret_rc" "$secret_fingerprint" "$tmp" <<'PY'
python3 - "$vault_put_rc" "$vault_metadata_rc" "$sync_rc" "$consumer_rollout_restart_rc" "$consumer_rollout_rc" "$consumer_env_rc" "$secretstore_rc" "$externalsecret_rc" "$secret_fingerprint" "$tmp" <<'PY'
import json, os, sys
vault_put_rc, vault_metadata_rc, sync_rc, consumer_env_rc, secretstore_rc, externalsecret_rc = [int(value) for value in sys.argv[1:7]]
secret_fingerprint = sys.argv[7]
tmp = sys.argv[8]
vault_put_rc, vault_metadata_rc, sync_rc, consumer_rollout_restart_rc, consumer_rollout_rc, consumer_env_rc, secretstore_rc, externalsecret_rc = [int(value) for value in sys.argv[1:9]]
secret_fingerprint = sys.argv[9]
tmp = sys.argv[10]
def text(name, limit=3000):
try:
return open(os.path.join(tmp, name), encoding="utf-8", errors="replace").read()[-limit:]
@@ -983,7 +999,7 @@ def conditions(obj):
status = (obj or {}).get("status") or {}
return [{"type": c.get("type"), "status": c.get("status"), "reason": c.get("reason"), "message": c.get("message")} for c in status.get("conditions", [])]
payload = {
"ok": vault_put_rc == 0 and vault_metadata_rc == 0 and sync_rc == 0 and consumer_env_rc == 0 and secretstore_rc == 0 and externalsecret_rc == 0,
"ok": vault_put_rc == 0 and vault_metadata_rc == 0 and sync_rc == 0 and consumer_rollout_restart_rc == 0 and consumer_rollout_rc == 0 and consumer_env_rc == 0 and secretstore_rc == 0 and externalsecret_rc == 0,
"target": "${target.id}",
"namespace": "${target.namespace}",
"checks": {
@@ -999,6 +1015,10 @@ payload = {
"stderrTail": text("secret.err"),
},
"consumerEnvInjection": {
"rolloutRestartExitCode": consumer_rollout_restart_rc,
"rolloutExitCode": consumer_rollout_rc,
"rolloutStdoutTail": text("consumer-rollout.out"),
"rolloutStderrTail": text("consumer-rollout.err"),
"exitCode": consumer_env_rc,
"deploymentName": "${secretPlane.syncProbe.consumer.deploymentName}",
"pod": text("consumer-pod.txt", 200),