mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden d601 k3s guards

Browse Source
This commit is contained in:
Codex
2026-05-23 16:21:45 +00:00
parent 026a718a24
commit c93fb275c5
14 changed files with 353 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/src/deploy.ts
+13 -4
View File
@@ -9,6 +9,7 @@ import { baiduNetdiskRuntimeSecretRequirements, runtimeSecretContractFromEnvText
import { startJob } from "./jobs";
import { coreInternalFetch } from "./microservices";
import { codeQueueSourceImportPreflight, codeQueueSourceSubdir } from "./code-queue-source-guard";
import { d601K3sGuardShellLines, d601NativeKubeconfig } from "./d601-k3s-guard";
import {
compareDeployJsonExecutorMirrors,
deployJsonCommitImage,
@@ -138,7 +139,7 @@ const providerDispatchCompletionLagMs = 45_000;
const pollIntervalMs = 5_000;
const remoteDeployRoot = "/home/ubuntu/.unidesk/deploy";
const k8sNamespace = "unidesk";
const k8sKubeconfig = "/etc/rancher/k3s/k3s.yaml";
const k8sKubeconfig = d601NativeKubeconfig;
// Production k3s hostPath repo. Code Queue production Pods mount this path as /app and /root/unidesk,
// so deploy guards must validate this tree rather than config.json development.worktreePath.
const k3sProductionHostPathRepoDir = "/home/ubuntu/cq-deploy";
@@ -260,6 +261,10 @@ function shellQuote(value: string): string {
return `'${value.replace(/'/gu, `'\\''`)}'`;
}
function d601K3sGuardScript(): string {
return d601K3sGuardShellLines(k8sKubeconfig).join("\n");
}
function compactTail(text: string, maxChars = 1600): string {
return text.length > maxChars ? text.slice(text.length - maxChars) : text;
}
@@ -1518,10 +1523,11 @@ function syncDevFrontendAuthScript(config: UniDeskConfig): string {
};
return [
"set -euo pipefail",
d601K3sGuardScript(),
`secret_patch=${shellQuote(JSON.stringify({ data }))}`,
`config_patch=${shellQuote(JSON.stringify({ data: runtimeConfig }))}`,
`KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl -n unidesk-dev patch secret unidesk-dev-runtime-secrets --type merge -p "$secret_patch"`,
`KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl -n unidesk-dev patch configmap unidesk-dev-runtime-config --type merge -p "$config_patch"`,
`kubectl -n unidesk-dev patch secret unidesk-dev-runtime-secrets --type merge -p "$secret_patch"`,
`kubectl -n unidesk-dev patch configmap unidesk-dev-runtime-config --type merge -p "$config_patch"`,
"echo dev_frontend_auth_synced=ok",
].join("\n");
}
@@ -2124,6 +2130,7 @@ function ensureNativeK3sScript(): string {
` if KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl get nodes >/dev/null 2>&1; then break; fi`,
" sleep 2",
"done",
d601K3sGuardScript(),
`KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl get nodes -l unidesk.ai/node-id=D601 --no-headers | grep -q .`,
`KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl wait --for=condition=Ready node -l unidesk.ai/node-id=D601 --timeout=180s`,
"install_system_images_from_legacy_k3s",
@@ -2248,8 +2255,10 @@ function applyK8sScript(service: UniDeskMicroserviceConfig): string {
].join("\n")
: "";
return [
"set -euo pipefail",
d601K3sGuardScript(),
cleanup,
`KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl apply -f ${shellQuote(manifest)}`,
`kubectl apply -f ${shellQuote(manifest)}`,
].filter(Boolean).join("\n");
}