Merge pull request #2130 from pikasTech/fix/pikaoa-pac-admission-bootstrap

修复 PikaOA PaC bootstrap admission 假就绪

docs/MDTODO/pikaoa-enterprise-platform.md

@@ -132,6 +132,9 @@
 ##### R1.5.9.13 [in_progress]
 
 接入仅跟随产品 master 的 pikaoa-test-nc01 独立测试 CI/CD，通过正常 source PR merge 自动交付 NC01 pikaoa-test，保持生产 consumer 不触发（pikasTech/unidesk#2105），完成任务后将详细报告写入[任务报告](./details/pikaoa-enterprise-platform/R1.5.9.13_Task_Report.md)。
+###### R1.5.9.13.1 [in_progress]
+
+修复 PikaOA 首次 PaC bootstrap 未同步 admission provenance desired policy/binding 的缺口，使配置指纹漂移降级为非阻塞 warning 且正常产品 PR merge 产生的 PipelineRun 能继续执行，执行记录见 [pikasTech/unidesk#2127](https://github.com/pikasTech/unidesk/issues/2127)，完成任务后将详细报告写入[任务报告](./details/pikaoa-enterprise-platform/R1.5.9.13.1_Task_Report.md)。
 ### R1.6
 
 审核并合并双仓 PR，执行首次受控 PaC bootstrap，由正常 source PR merge 自动发布，依赖 R1.3-R1.5，完成任务后将详细报告写入[任务报告](./details/pikaoa-enterprise-platform/R1.6_Task_Report.md)。

scripts/src/pikaoa-test-delivery-renderer.test.ts

@@ -48,6 +48,15 @@ describe("PikaOA test PaC renderer", () => {
       const rendered = renderPikaoaTestDesiredPipeline(rendererBinding(), source);
       const spec = rendered.pipeline.spec as Record<string, unknown>;
       const tasks = spec.tasks as Array<Record<string, unknown>>;
+      for (const task of tasks) {
+        const taskSpec = task.taskSpec as Record<string, unknown>;
+        expect(taskSpec.workspaces).toEqual([{ name: "workspace", mountPath: "/workspace" }]);
+        const steps = taskSpec.steps as Array<Record<string, unknown>>;
+        for (const step of steps) {
+          const mounts = (step.volumeMounts ?? []) as Array<Record<string, unknown>>;
+          expect(mounts.some((mount) => mount.name === "workspace")).toBe(false);
+        }
+      }
       for (const name of ["build-api", "build-worker", "build-web"]) {
         const task = tasks.find((item) => item.name === name);
         expect(task?.runAfter).toEqual(["source"]);

scripts/src/pikaoa-test-delivery-renderer.ts

@@ -98,7 +98,7 @@ function sourceTask(target: TestTargetSpec): Record<string, unknown> {
         { name: "gitops-username", type: "string" },
         { name: "gitops-secret-name", type: "string" },
       ],
-      workspaces: [{ name: "workspace" }],
+      workspaces: [{ name: "workspace", mountPath: "/workspace" }],
       steps: [{
         name: "checkout",
         image: target.ci.toolsImage,
@@ -132,7 +132,6 @@ printf '{"ok":true,"phase":"source","sourceCommit":"%s","valuesPrinted":false}\n
 `,
         securityContext: nonRootSecurity(),
         volumeMounts: [
-          { name: "workspace", mountPath: "/workspace" },
           { name: "source-token", mountPath: "/var/run/pikaoa-source", readOnly: true },
         ],
       }],
@@ -158,7 +157,7 @@ function imageBuildTask(target: TestTargetSpec, component: "api" | "worker" | "w
     runAfter: ["source"],
     taskSpec: {
       params: [{ name: "revision", type: "string" }],
-      workspaces: [{ name: "workspace" }],
+      workspaces: [{ name: "workspace", mountPath: "/workspace" }],
       results: [{ name: "digest", type: "string" }, { name: "image", type: "string" }],
       steps: [{
         name: "build",
@@ -186,7 +185,6 @@ printf '%s@%s' ${shellSingleQuote(imageRepository)} "$digest" > "$(results.image
 printf '{"ok":true,"phase":"${taskName}","sourceCommit":"%s","imageTag":"%s","digest":"%s","valuesPrinted":false}\n' "$revision" "$tag" "$digest"
 `,
         securityContext: { privileged: true, runAsUser: 1000, runAsGroup: 1000 },
-        volumeMounts: [{ name: "workspace", mountPath: "/workspace" }],
       }],
     },
     params: [{ name: "revision", value: "$(params.revision)" }],
@@ -210,7 +208,7 @@ function gitOpsTask(target: TestTargetSpec, runtimeManifest: string): Record<str
         { name: "worker-image", type: "string" },
         { name: "web-image", type: "string" },
       ],
-      workspaces: [{ name: "workspace" }],
+      workspaces: [{ name: "workspace", mountPath: "/workspace" }],
       steps: [{
         name: "publish",
         image: target.ci.toolsImage,
@@ -281,7 +279,6 @@ printf '{"ok":true,"status":"published","phase":"gitops-publish","sourceCommitId
 `,
         securityContext: nonRootSecurity(),
         volumeMounts: [
-          { name: "workspace", mountPath: "/workspace" },
           { name: "gitops-token", mountPath: "/var/run/pikaoa-gitops", readOnly: true },
         ],
       }],

scripts/src/platform-infra-pipelines-as-code-bootstrap.test.ts

@@ -166,10 +166,16 @@ test("PaC apply checks the Gitea repository before dry-run return and cluster mu
   const preflight = remote.indexOf("if ! repository_preflight", action);
   const dryRun = remote.indexOf('if [ "$UNIDESK_PAC_DRY_RUN" = "1" ]', action);
   const release = remote.indexOf("  apply_release", action);
+  const admission = remote.indexOf("    apply_admission_manifest", release);
+  const rbac = remote.indexOf("    rbac_tmp=$(mktemp)", admission);
   expect(action).toBeGreaterThanOrEqual(0);
   expect(preflight).toBeGreaterThan(action);
   expect(dryRun).toBeGreaterThan(preflight);
   expect(release).toBeGreaterThan(dryRun);
+  expect(admission).toBeGreaterThan(release);
+  expect(rbac).toBeGreaterThan(admission);
+  expect(remote).toContain('"admission":{"applied":%s,"ready":%s}');
+  expect(remote).toContain('"admissionProvenance":%s');
   expect(remote).toContain('"error":"gitea-repository-missing"');
 });
 
@@ -197,7 +203,7 @@ test("PaC bootstrap projects typed stages and compact JSON", () => {
   const projection = projectPacBootstrapResult(result);
   expect(projection.ok).toBe(true);
   expect(JSON.stringify(projection)).not.toContain("pipelinesAsCodeApply");
-  expect((projection.stages as Record<string, unknown>[]).map((item) => item.id)).toEqual(["gitea-init", "pac-controller", "tekton-consumer", "gitops-argo"]);
+  expect((projection.stages as Record<string, unknown>[]).map((item) => item.id)).toEqual(["gitea-init", "pac-controller", "pac-admission", "tekton-consumer", "gitops-argo"]);
   const rendered = renderPacBootstrap(result).renderedText;
   expect(rendered).toContain("PRECONDITIONS");
   expect(rendered).toContain("yaml-repository-exact-match");
@@ -237,6 +243,6 @@ test("PaC bootstrap distinguishes GitHub access failure from Gitea and PaC stage
   });
   expect((projection.blockers as Record<string, unknown>[])).toEqual([{ code: "github-repository-not-found-or-no-access", stage: "github-upstream", reason: "repository unavailable" }]);
   expect((projection.preconditions as Record<string, unknown>[])[2]).toMatchObject({ ok: null, code: "gitea-bootstrap-skipped" });
-  expect((projection.stages as Record<string, unknown>[]).map((item) => item.state)).toEqual(["skipped", "skipped", "skipped", "skipped"]);
+  expect((projection.stages as Record<string, unknown>[]).map((item) => item.state)).toEqual(["skipped", "skipped", "skipped", "skipped", "skipped"]);
   expect((projection.next as Record<string, unknown>).kind).toBe("read-only-status");
 });

scripts/src/platform-infra-pipelines-as-code-bootstrap.ts

@@ -69,6 +69,7 @@ export function projectPacBootstrapResult(result: Record<string, unknown>): Reco
   const gitea = record(result.giteaBootstrap);
   const apply = record(result.pipelinesAsCodeApply);
   const remote = record(apply.remote);
+  const admission = record(remote.admission);
   const blockers = bootstrapBlockers(githubPreflight, gitea, apply, remote);
   const dryRun = result.mode === "dry-run";
   const repositoryMissing = remote.error === "gitea-repository-missing";
@@ -101,6 +102,7 @@ export function projectPacBootstrapResult(result: Record<string, unknown>): Reco
     stages: [
       { id: "gitea-init", ok: giteaSkipped ? null : giteaReady, state: giteaSkipped ? "skipped" : giteaReady ? (dryRun ? "planned" : "ready") : "failed", mutation: gitea.mutation === true },
       { id: "pac-controller", ok: applySkipped ? null : applyReady, state: applySkipped ? "skipped" : repositoryMissing ? "waiting-for-gitea-confirm" : applyReady ? (dryRun ? "planned" : "ready") : "failed", mutation: apply.mutation === true },
+      { id: "pac-admission", ok: applySkipped ? null : dryRun ? true : admission.ready === true, state: applySkipped ? "skipped" : repositoryMissing ? "waiting-for-gitea-confirm" : dryRun ? "planned" : admission.ready === true ? "ready" : "failed", mutation: admission.applied === true },
       { id: "tekton-consumer", ok: applySkipped ? null : applyReady, state: applySkipped ? "skipped" : repositoryMissing ? "waiting-for-gitea-confirm" : applyReady ? (dryRun ? "planned" : "ready") : "failed", mutation: apply.mutation === true },
       { id: "gitops-argo", ok: applySkipped ? null : applyReady, state: applySkipped ? "skipped" : repositoryMissing ? "waiting-for-gitea-confirm" : applyReady ? (dryRun ? "planned" : "ready") : "failed", mutation: apply.mutation === true },
     ],

scripts/src/platform-infra-pipelines-as-code-remote.sh

@@ -284,6 +284,13 @@ apply_release() {
   rm -f "$tmp"
 }
 
+apply_admission_manifest() {
+  tmp=$(mktemp)
+  printf '%s' "$UNIDESK_PAC_ADMISSION_MANIFEST_B64" | base64 -d > "$tmp"
+  kubectl apply --server-side --force-conflicts --field-manager="$UNIDESK_PAC_FIELD_MANAGER-admission-bootstrap" -f "$tmp" >/dev/null
+  rm -f "$tmp"
+}
+
 wait_ready() {
   timeout="${UNIDESK_PAC_WAIT_TIMEOUT_SECONDS:-55}"
   end=$(( $(now_epoch) + timeout ))
@@ -313,6 +320,11 @@ apply_action() {
     return
   fi
   apply_release
+  admission_applied=false
+  if [ "${UNIDESK_PAC_DELIVERY_PROVENANCE_REQUIRED:-0}" = "1" ]; then
+    apply_admission_manifest
+    admission_applied=true
+  fi
   kubectl create ns "$UNIDESK_PAC_TARGET_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f - >/dev/null
   if [ "${UNIDESK_PAC_DELIVERY_PROVENANCE_REQUIRED:-0}" = "1" ]; then
     rbac_tmp=$(mktemp)
@@ -351,7 +363,16 @@ apply_action() {
   hook_id=$(ensure_webhook)
   ready=false
   if wait_ready; then ready=true; fi
-  printf '{"ok":%s,"mode":"confirmed","mutation":true,"controllerReady":%s,"argoBootstrap":%s,"preflight":{"repositoryExists":true,"httpStatus":"2xx","repository":"%s/%s","valuesPrinted":false},"webhook":{"present":true,"id":"%s","url":"%s"},"repository":"%s","namespace":"%s","valuesPrinted":false}\n' "$ready" "$ready" "$argo_bootstrap" "$(json_string "$UNIDESK_PAC_GITEA_OWNER")" "$(json_string "$UNIDESK_PAC_GITEA_REPO")" "$(json_string "$hook_id")" "$(json_string "$UNIDESK_PAC_WEBHOOK_URL")" "$(json_string "$UNIDESK_PAC_REPOSITORY_NAME")" "$(json_string "$UNIDESK_PAC_TARGET_NAMESPACE")"
+  admission_ready=true
+  if [ "${UNIDESK_PAC_DELIVERY_PROVENANCE_REQUIRED:-0}" = "1" ]; then
+    admission_ready=false
+    if wait_admission_ready; then admission_ready=true; fi
+  else
+    prepare_admission_provenance_state
+  fi
+  ok=false
+  if [ "$ready" = true ] && [ "$admission_ready" = true ]; then ok=true; fi
+  printf '{"ok":%s,"mode":"confirmed","mutation":true,"controllerReady":%s,"admission":{"applied":%s,"ready":%s},"admissionProvenance":%s,"argoBootstrap":%s,"preflight":{"repositoryExists":true,"httpStatus":"2xx","repository":"%s/%s","valuesPrinted":false},"webhook":{"present":true,"id":"%s","url":"%s"},"repository":"%s","namespace":"%s","valuesPrinted":false}\n' "$ok" "$ready" "$admission_applied" "$admission_ready" "$UNIDESK_PAC_ADMISSION_STATE_JSON" "$argo_bootstrap" "$(json_string "$UNIDESK_PAC_GITEA_OWNER")" "$(json_string "$UNIDESK_PAC_GITEA_REPO")" "$(json_string "$hook_id")" "$(json_string "$UNIDESK_PAC_WEBHOOK_URL")" "$(json_string "$UNIDESK_PAC_REPOSITORY_NAME")" "$(json_string "$UNIDESK_PAC_TARGET_NAMESPACE")"
 }
 
 condition_status() {
@@ -415,6 +436,19 @@ prepare_admission_provenance_state() {
   export UNIDESK_PAC_ADMISSION_STATE_JSON
 }
 
+wait_admission_ready() {
+  timeout="${UNIDESK_PAC_WAIT_TIMEOUT_SECONDS:-55}"
+  end=$(( $(now_epoch) + timeout ))
+  while :; do
+    prepare_admission_provenance_state
+    if printf '%s' "$UNIDESK_PAC_ADMISSION_STATE_JSON" | node -e 'let input="";process.stdin.on("data",chunk=>input+=chunk);process.stdin.on("end",()=>process.exit(JSON.parse(input).ready===true?0:1));'; then
+      return 0
+    fi
+    if [ "$(now_epoch)" -ge "$end" ]; then return 1; fi
+    sleep 2
+  done
+}
+
 pipeline_rows() {
   payload_file=$(mktemp)
   kubectl -n "$UNIDESK_PAC_TARGET_NAMESPACE" get pipelinerun -o json >"$payload_file" 2>/dev/null || printf '{"items":[]}' >"$payload_file"

scripts/src/platform-infra-pipelines-as-code.ts

@@ -28,7 +28,7 @@ import {
   type PacSourceArtifactRuntimeObservation,
   type PacSourceArtifactSpec,
 } from "./platform-infra-pipelines-as-code-source-artifact";
-import { pacAdmissionDesiredIdentity } from "./platform-infra-pac-provenance";
+import { pacAdmissionDesiredIdentity, renderPacAdmissionDesiredFragment } from "./platform-infra-pac-provenance";
 import { pacConsumerRbacDesiredIdentity, renderPacConsumerRbacDesiredFragment } from "./platform-infra-pac-consumer-rbac";
 import { runGiteaMirrorBootstrapPreflight, runPlatformInfraGiteaCommand } from "./platform-infra-gitea";
 import { readGiteaConfig } from "./platform-infra-gitea-config";
@@ -1754,6 +1754,7 @@ function remoteScript(action: "apply" | "status" | "history" | "debug-step", pac
     UNIDESK_PAC_PIPELINE_RUN_PREFIX: consumer.pipelineRunPrefix,
     UNIDESK_PAC_CONSUMER_CONFIG_B64: Buffer.from(JSON.stringify(consumerConfig), "utf8").toString("base64"),
     UNIDESK_PAC_DELIVERY_PROVENANCE_REQUIRED: consumer.deliveryProvenance?.required === true ? "1" : "0",
+    UNIDESK_PAC_ADMISSION_MANIFEST_B64: Buffer.from(renderPacAdmissionDesiredFragment(target.id), "utf8").toString("base64"),
     UNIDESK_PAC_CONSUMER_RBAC_MANIFEST_B64: Buffer.from(renderPacConsumerRbacDesiredFragment(target.id), "utf8").toString("base64"),
     UNIDESK_PAC_RUNNER_SERVICE_ACCOUNT_MANIFEST_B64: Buffer.from(runnerServiceAccountManifest(consumer), "utf8").toString("base64"),
     UNIDESK_PAC_RUNNER_SERVICE_ACCOUNT_NAME: consumer.runnerServiceAccount?.name ?? "",