mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden d601 k3s guards

Browse Source
This commit is contained in:
Codex
2026-05-23 16:21:45 +00:00
parent 026a718a24
commit c93fb275c5
14 changed files with 353 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/hwlab-cd-wrapper-contract-test.ts
+59 -7
View File
@@ -56,19 +56,30 @@ function makeFakeHwlabRepo(): string {
return root;
}
function makeFakeBin(mode: "native" | "desktop"): string {
function makeFakeBin(mode: "native" | "desktop" | "stale-default" | "wrong-node"): string {
const bin = join(tmpdir(), `unidesk-hwlab-cd-bin-${process.pid}-${Date.now()}-${mode}`);
mkdirSync(bin, { recursive: true });
const context = mode === "desktop" ? "docker-desktop" : "default";
const server = mode === "desktop" ? "https://127.0.0.1:11700" : "https://127.0.0.1:6443";
const nodes = mode === "desktop" ? "desktop-control-plane" : "d601";
const explicitContext = mode === "desktop" ? "docker-desktop" : "default";
const explicitServer = mode === "desktop" ? "https://127.0.0.1:11700" : "https://127.0.0.1:6443";
const explicitNodes = mode === "desktop" ? "desktop-control-plane" : mode === "wrong-node" ? "d602" : "d601";
const defaultContext = mode === "stale-default" ? "docker-desktop" : explicitContext;
const defaultServer = mode === "stale-default" ? "https://127.0.0.1:11700" : explicitServer;
const defaultNodes = mode === "stale-default" ? "desktop-control-plane" : explicitNodes;
writeFileSync(join(bin, "kubectl"), [
"#!/usr/bin/env bash",
"set -euo pipefail",
"printf 'KUBECONFIG=%s\\n' \"${KUBECONFIG:-}\" >&2",
"if [[ \"$*\" == 'config current-context' ]]; then printf '%s\\n' " + JSON.stringify(context) + "; exit 0; fi",
"if [[ \"$*\" == 'config view --minify -o jsonpath={.clusters[0].cluster.server}' ]]; then printf '%s' " + JSON.stringify(server) + "; exit 0; fi",
"if [[ \"$*\" == 'get nodes -o jsonpath={range .items[*]}{.metadata.name}{\"\\n\"}{end}' ]]; then printf '%s\\n' " + JSON.stringify(nodes) + "; exit 0; fi",
"context=" + JSON.stringify(explicitContext),
"server=" + JSON.stringify(explicitServer),
"nodes=" + JSON.stringify(explicitNodes),
"if [[ \"${KUBECONFIG:-}\" == '' ]]; then",
" context=" + JSON.stringify(defaultContext),
" server=" + JSON.stringify(defaultServer),
" nodes=" + JSON.stringify(defaultNodes),
"fi",
"if [[ \"$*\" == 'config current-context' ]]; then printf '%s\\n' \"$context\"; exit 0; fi",
"if [[ \"$*\" == 'config view --minify -o jsonpath={.clusters[0].cluster.server}' ]]; then printf '%s' \"$server\"; exit 0; fi",
"if [[ \"$*\" == 'get nodes -o jsonpath={range .items[*]}{.metadata.name}{\"\\n\"}{end}' ]]; then printf '%s\\n' \"$nodes\"; exit 0; fi",
"if [[ \"$*\" == '-n hwlab-dev get lease hwlab-dev-cd-lock -o json' ]]; then printf 'Error from server (NotFound): leases.coordination.k8s.io \"hwlab-dev-cd-lock\" not found\\n' >&2; exit 1; fi",
"printf '{}\\n'",
].join("\n"));
@@ -79,6 +90,8 @@ function makeFakeBin(mode: "native" | "desktop"): string {
const fakeRepo = makeFakeHwlabRepo();
const nativeBin = makeFakeBin("native");
const desktopBin = makeFakeBin("desktop");
const staleDefaultBin = makeFakeBin("stale-default");
const wrongNodeBin = makeFakeBin("wrong-node");
const liveBody = "data:application/json,%7B%22serviceId%22%3A%22hwlab-cloud-web%22%2C%22environment%22%3A%22dev%22%2C%22status%22%3A%22ok%22%2C%22revision%22%3A%22abc1234%22%7D";
const apiBody = "data:application/json,%7B%22serviceId%22%3A%22hwlab-cloud-api%22%2C%22environment%22%3A%22dev%22%2C%22status%22%3A%22ok%22%2C%22revision%22%3A%22abc1234%22%7D";
@@ -103,6 +116,7 @@ const dryRunData = applyDryRun.data as JsonRecord;
assert.equal(dryRunData.dryRun, true);
assert.equal(dryRunData.mutation, false);
assert.equal(((dryRunData.d601NativeK3sGuard as JsonRecord).injectedEnv as JsonRecord).KUBECONFIG, "/etc/rancher/k3s/k3s.yaml");
assert.equal((dryRunData.d601NativeK3sGuard as JsonRecord).requiredNodePresent, true);
assert.equal((dryRunData.controlledDryRun as JsonRecord).commandOk, true);
assert.equal(((dryRunData.hostCommanderOnlyLiveApply as JsonRecord).commandShape as unknown[]).includes("scripts/dev-cd-apply.mjs"), true);
@@ -139,6 +153,26 @@ assert.equal(((statusData.d601NativeK3sGuard as JsonRecord).injectedEnv as JsonR
assert.equal((statusData.liveRevisions as JsonRecord).status, "observed");
assert.ok(typeof statusData.dumpDir === "string" && String(statusData.dumpDir).includes(".state/hwlab-cd"));
const staleDefaultOk = runCli([
"hwlab",
"cd",
"apply",
"--env",
"dev",
"--dry-run",
"--hwlab-repo",
fakeRepo,
], {
PATH: `${staleDefaultBin}:${process.env.PATH ?? ""}`,
KUBECONFIG: "",
});
assert.equal(staleDefaultOk.ok, true);
const staleDefaultGuard = (staleDefaultOk.data as JsonRecord).d601NativeK3sGuard as JsonRecord;
assert.equal(staleDefaultGuard.status, "pass");
assert.equal(staleDefaultGuard.refusal, false);
assert.equal((staleDefaultGuard.defaultKubectlDiagnostic as JsonRecord).status, "stale-forbidden-default");
assert.deepEqual((staleDefaultGuard.defaultKubectlDiagnostic as JsonRecord).refusalSignals, ["docker-desktop", "desktop-control-plane", "127.0.0.1:11700"]);
const desktopRefusal = runCli([
"hwlab",
"cd",
@@ -155,4 +189,22 @@ assert.equal(desktopRefusal.ok, false);
assert.equal((desktopRefusal.data as JsonRecord).error, "native-k3s-guard-refused");
assert.deepEqual((desktopRefusal.data as JsonRecord).d601NativeK3sGuard && ((desktopRefusal.data as JsonRecord).d601NativeK3sGuard as JsonRecord).refusalSignals, ["docker-desktop", "desktop-control-plane", "127.0.0.1:11700"]);
const wrongNodeBlocked = runCli([
"hwlab",
"cd",
"apply",
"--env",
"dev",
"--dry-run",
"--hwlab-repo",
fakeRepo,
], {
PATH: `${wrongNodeBin}:${process.env.PATH ?? ""}`,
});
assert.equal(wrongNodeBlocked.ok, true);
const wrongNodeGuard = (wrongNodeBlocked.data as JsonRecord).d601NativeK3sGuard as JsonRecord;
assert.equal(wrongNodeGuard.status, "blocked");
assert.equal(wrongNodeGuard.requiredNodePresent, false);
assert.equal(((wrongNodeBlocked.data as JsonRecord).blockers as JsonRecord[]).some((blocker) => blocker.scope === "d601-native-k3s-guard"), true);
console.log(JSON.stringify({ ok: true, checked: "hwlab-cd-wrapper-contract" }));