fix(pikaoa): 修正附件卷 nonroot 写权限

config/fixtures/pikaoa-test-target.yaml

@@ -56,6 +56,7 @@ testRuntime:
           claimName: pikaoa-attachments
           storageRequest: 1Gi
           storageClassName: null
+          fsGroup: 65532
           accessModes:
             - ReadWriteOnce
         workerInterval: 2s

config/pikaoa.yaml

@@ -75,6 +75,7 @@ testRuntime:
           claimName: pikaoa-attachments
           storageRequest: 10Gi
           storageClassName: null
+          fsGroup: 65532
           accessModes:
             - ReadWriteOnce
         workerInterval: 2s

scripts/src/pikaoa-test-target-async.test.ts

@@ -169,6 +169,7 @@ exit 64
     const objects = plan.objects as Array<Record<string, unknown>>;
     assert.equal(objects.some((object) => object.kind === "StatefulSet" || object.name === "pikaoa-postgres"), false);
     assert.equal(objects.some((object) => object.kind === "Deployment" && object.name === "pikaoa-web"), true);
+    assert.equal(objects.find((object) => object.kind === "Deployment" && object.name === "pikaoa-api")?.podFsGroup, 65532);
     assert.deepEqual(plan.exposure, { serviceType: "NodePort", serviceName: "pikaoa-web", hostIP: "192.0.2.10", port: 32080 });
 
     const missing = await projection("status", "runtime", false, "api");

scripts/src/pikaoa-test-target.ts

@@ -78,6 +78,7 @@ interface TestTargetSpec {
       claimName: string;
       storageRequest: string;
       storageClassName: string | null;
+      fsGroup: number;
       accessModes: string[];
     };
     workerInterval: string;
@@ -351,6 +352,7 @@ function parseTarget(id: string, root: Record<string, unknown>, configLabel: str
         claimName: kubernetesName(nonEmpty(attachment.claimName, `${path}.runtime.attachment.claimName`), `${path}.runtime.attachment.claimName`, 63),
         storageRequest: nonEmpty(attachment.storageRequest, `${path}.runtime.attachment.storageRequest`),
         storageClassName: nullableString(attachment.storageClassName, `${path}.runtime.attachment.storageClassName`),
+        fsGroup: positiveInteger(attachment.fsGroup, `${path}.runtime.attachment.fsGroup`, 2_147_483_647),
         accessModes: enumStringList(attachment.accessModes, `${path}.runtime.attachment.accessModes`, ["ReadWriteOnce", "ReadOnlyMany", "ReadWriteMany", "ReadWriteOncePod"]),
       },
       workerInterval: duration(runtime.workerInterval, `${path}.runtime.workerInterval`),
@@ -506,6 +508,7 @@ function renderedPlan(selection: Selection, context: RenderContext): Record<stri
       claimName: target.runtime.attachment.claimName,
       storageRequest: target.runtime.attachment.storageRequest,
       storageClassName: target.runtime.attachment.storageClassName,
+      fsGroup: target.runtime.attachment.fsGroup,
       accessModes: target.runtime.attachment.accessModes,
     },
     migration: {
@@ -745,6 +748,7 @@ function deployment(
       template: {
         metadata: { labels: { ...labels, ...selector }, annotations },
         spec: {
+          ...(component === "api" ? { securityContext: { fsGroup: target.runtime.attachment.fsGroup } } : {}),
           containers: [{
             name: component, image, imagePullPolicy: target.source.pullPolicy, env,
             ports: [{ name: component === "worker" ? "metrics" : "http", containerPort: port }],
@@ -1450,10 +1454,15 @@ function namespaceAnnotations(target: TestTargetSpec, context: RenderContext): R
 function objectSummary(object: Record<string, unknown>): Record<string, unknown> {
   const metadata = optionalRecord(object.metadata, "metadata") ?? {};
   const labels = optionalRecord(metadata.labels, "metadata.labels") ?? {};
+  const spec = optionalRecord(object.spec, "spec") ?? {};
+  const template = optionalRecord(spec.template, "spec.template") ?? {};
+  const podSpec = optionalRecord(template.spec, "spec.template.spec") ?? {};
+  const securityContext = optionalRecord(podSpec.securityContext, "spec.template.spec.securityContext") ?? {};
   return {
     kind: object.kind ?? null,
     name: metadata.name ?? null,
     owned: labels["app.kubernetes.io/managed-by"] === MANAGED_BY && labels[TEST_RUNTIME_LABEL] === "true" && typeof labels[TARGET_LABEL] === "string" && typeof labels[INSTANCE_LABEL] === "string",
+    podFsGroup: securityContext.fsGroup,
     secretValuesRedacted: object.kind === "Secret" ? true : undefined,
   };
 }