mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(sub2api): add JD01 account local proxy

Browse Source
This commit is contained in:
Codex
2026-06-30 10:38:03 +00:00
parent b1fda2a479
commit b073a1c52c
9 changed files with 395 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/src/platform-infra/validate-script.ts
+38 -3
View File
@@ -175,6 +175,7 @@ export function validateExternalActiveScript(sub2api: Sub2ApiConfig, target: Sub
const cleanupPlan = managedResourceCleanupPlan(sub2api, target);
const exposure = target.publicExposure?.enabled ? target.publicExposure : null;
const proxy = target.egressProxy?.enabled ? target.egressProxy : null;
const accountLocalProxy = target.accountLocalProxy?.enabled ? target.accountLocalProxy : null;
const proxyUrl = proxy === null ? "" : `http://${proxy.serviceName}.${target.namespace}.svc.cluster.local:${proxy.listenPort}`;
const egressSubscriptionDiagnostics = proxy === null ? null : safeEgressProxySubscriptionDiagnostics(sub2api, proxy);
const egressSubscriptionJson = egressSubscriptionDiagnostics === null ? "None" : `json.loads(${JSON.stringify(JSON.stringify(egressSubscriptionDiagnostics))})`;
@@ -272,6 +273,38 @@ fi
},
}`;
const publicProbeOkExpr = exposure === null ? "True" : "(public_dns_rc == 0 and public_probe_rc == 0)";
const accountLocalProxyBlock = accountLocalProxy === null ? `
account_local_proxy_probe_rc=0
: >"$tmp/account-local-proxy-probe.out"
: >"$tmp/account-local-proxy-probe.err"
` : `
if [ -n "$app_pod" ]; then
kubectl -n ${target.namespace} exec "$app_pod" -c sub2api -- sh -c 'HTTP_PROXY="$1" HTTPS_PROXY="$1" ALL_PROXY="$1" NO_PROXY="$2" curl -fsS --max-time 20 -o /dev/null -w "status=%{http_code}\\n" "$3"' sh ${shQuote(`http://${accountLocalProxy.listenHost}:${accountLocalProxy.listenPort}`)} ${shQuote("localhost,127.0.0.1,::1,.svc,.cluster.local,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16")} ${shQuote(accountLocalProxy.healthProbeUrl)} >"$tmp/account-local-proxy-probe.out" 2>"$tmp/account-local-proxy-probe.err"
account_local_proxy_probe_rc=$?
else
account_local_proxy_probe_rc=1
printf '%s\\n' 'sub2api app pod not found' >"$tmp/account-local-proxy-probe.err"
fi
`;
const accountLocalProxyJson = accountLocalProxy === null ? "None" : `{
"enabled": True,
"mode": "sub2api-pod-loopback-account-proxy",
"containerName": "${accountLocalProxy.containerName}",
"secretName": "${accountLocalProxy.secretName}",
"proxyUrl": "http://${accountLocalProxy.listenHost}:${accountLocalProxy.listenPort}",
"healthProbeUrl": "${accountLocalProxy.healthProbeUrl}",
"sourceRef": "${accountLocalProxy.sourceRef}",
"sourceConfigRef": "${accountLocalProxy.sourceConfigRef}",
"sourceFingerprint": "${accountLocalProxy.sourceFingerprint}",
"probe": {
"exitCode": account_local_proxy_probe_rc,
"failureFamily": egress_failure_family(account_local_proxy_probe_rc, text("account-local-proxy-probe.err", 2000), text("account-local-proxy-probe.out", 2000)),
"stdout": text("account-local-proxy-probe.out", 2000),
"stderr": text("account-local-proxy-probe.err", 2000),
},
"valuesPrinted": False,
}`;
const accountLocalProxyOkExpr = accountLocalProxy === null ? "True" : "(account_local_proxy_probe_rc == 0)";
return `
set -u
tmp="$(mktemp -d)"
@@ -312,13 +345,14 @@ else
fi
${publicProbeBlock}
${egressProbeBlock}
python3 - "$tmp" "$health_rc" "$root_rc" "$redis_rc" "$public_dns_rc" "$public_probe_rc" "$egress_deploy_rc" "$egress_svc_rc" "$egress_probe_rc" <<'PY'
${accountLocalProxyBlock}
python3 - "$tmp" "$health_rc" "$root_rc" "$redis_rc" "$public_dns_rc" "$public_probe_rc" "$egress_deploy_rc" "$egress_svc_rc" "$egress_probe_rc" "$account_local_proxy_probe_rc" <<'PY'
import json
import os
import sys
tmp = sys.argv[1]
health_rc, root_rc, redis_rc, public_dns_rc, public_probe_rc, egress_deploy_rc, egress_svc_rc, egress_probe_rc = [int(value) for value in sys.argv[2:]]
health_rc, root_rc, redis_rc, public_dns_rc, public_probe_rc, egress_deploy_rc, egress_svc_rc, egress_probe_rc, account_local_proxy_probe_rc = [int(value) for value in sys.argv[2:]]
def rc(name):
try:
@@ -417,7 +451,7 @@ env_aligned = (
and env.get("DATABASE_PASSWORD_PRESENT") == "true"
)
payload = {
"ok": health_rc == 0 and root_rc == 0 and redis_rc == 0 and network_policy_ok and len(missing_secret_keys) == 0 and env_aligned and not local_postgres_present and not redis_pvc_present and ${publicProbeOkExpr} and ${egressProbeOkExpr},
"ok": health_rc == 0 and root_rc == 0 and redis_rc == 0 and network_policy_ok and len(missing_secret_keys) == 0 and env_aligned and not local_postgres_present and not redis_pvc_present and ${publicProbeOkExpr} and ${egressProbeOkExpr} and ${accountLocalProxyOkExpr},
"target": "${target.id}",
"namespace": "${target.namespace}",
"status": "external-db-active",
@@ -434,6 +468,7 @@ payload = {
},
"publicExposure": ${publicProbeJson},
"egressProxy": ${egressProbeJson},
"accountLocalProxy": ${accountLocalProxyJson},
"checks": {
"allowAllNetworkPolicy": {"exitCode": rc("networkpolicy"), "ok": network_policy_ok, "stderr": text("networkpolicy.err", 2000)},
"secretReady": {"ok": len(missing_secret_keys) == 0, "missingKeys": missing_secret_keys, "valuesPrinted": False},