fix: add yaml ssh secret for d518 git mirror

scripts/src/hwlab-node/entry.ts

@@ -401,7 +401,17 @@ export interface NodeRuntimeGitMirrorTargetSpec {
 }
 
 export type NodeRuntimeGitMirrorGithubTransportSpec =
-  | { mode: "ssh" }
+  | {
+    mode: "ssh";
+    privateKeySecretKey: string;
+    privateKeySourceRef: string;
+    privateKeySourceKey: string;
+    privateKeySourceEncoding: "plain" | "base64";
+    knownHostsSecretKey: string | null;
+    knownHostsSourceRef: string | null;
+    knownHostsSourceKey: string | null;
+    knownHostsSourceEncoding: "plain" | "base64" | null;
+  }
   | {
     mode: "https";
     username: string;

scripts/src/hwlab-node/render.ts

@@ -131,7 +131,21 @@ export function nodeRuntimeGitMirrorGithubTransportEnv(mirror: NodeRuntimeGitMir
 
 export function nodeRuntimeGitMirrorGithubTransportSummary(mirror: NodeRuntimeGitMirrorTargetSpec): Record<string, unknown> {
   const transport = mirror.githubTransport;
-  if (transport.mode === "ssh") return { mode: "ssh", secretName: mirror.secretName, valuesPrinted: false };
+  if (transport.mode === "ssh") {
+    return {
+      mode: "ssh",
+      secretName: mirror.secretName,
+      privateKeySecretKey: transport.privateKeySecretKey,
+      privateKeySourceRef: transport.privateKeySourceRef,
+      privateKeySourceKey: transport.privateKeySourceKey,
+      privateKeySourceEncoding: transport.privateKeySourceEncoding,
+      knownHostsSecretKey: transport.knownHostsSecretKey,
+      knownHostsSourceRef: transport.knownHostsSourceRef,
+      knownHostsSourceKey: transport.knownHostsSourceKey,
+      knownHostsSourceEncoding: transport.knownHostsSourceEncoding,
+      valuesPrinted: false,
+    };
+  }
   return {
     mode: "https",
     username: transport.username,

scripts/src/hwlab-node/status.ts

@@ -67,6 +67,13 @@ export function nodeRuntimeGitMirrorStatus(scoped: ReturnType<typeof parseNodeSc
     `cache_pvc=${shellQuote(mirror.cachePvcName)}`,
     `cache_host_path=${shellQuote(mirror.cacheHostPath ?? "")}`,
     `github_transport_mode=${shellQuote(mirror.githubTransport.mode)}`,
+    `github_ssh_secret=${shellQuote(mirror.githubTransport.mode === "ssh" ? mirror.secretName : "")}`,
+    `github_ssh_private_key=${shellQuote(mirror.githubTransport.mode === "ssh" ? mirror.githubTransport.privateKeySecretKey : "")}`,
+    `github_ssh_private_source_ref=${shellQuote(mirror.githubTransport.mode === "ssh" ? mirror.githubTransport.privateKeySourceRef : "")}`,
+    `github_ssh_private_source_key=${shellQuote(mirror.githubTransport.mode === "ssh" ? mirror.githubTransport.privateKeySourceKey : "")}`,
+    `github_ssh_known_hosts_key=${shellQuote(mirror.githubTransport.mode === "ssh" ? mirror.githubTransport.knownHostsSecretKey ?? "" : "")}`,
+    `github_ssh_known_hosts_source_ref=${shellQuote(mirror.githubTransport.mode === "ssh" ? mirror.githubTransport.knownHostsSourceRef ?? "" : "")}`,
+    `github_ssh_known_hosts_source_key=${shellQuote(mirror.githubTransport.mode === "ssh" ? mirror.githubTransport.knownHostsSourceKey ?? "" : "")}`,
     `github_token_secret=${shellQuote(mirror.githubTransport.mode === "https" ? mirror.githubTransport.tokenSecretName : "")}`,
     `github_token_key=${shellQuote(mirror.githubTransport.mode === "https" ? mirror.githubTransport.tokenSecretKey : "")}`,
     `github_token_source_ref=${shellQuote(mirror.githubTransport.mode === "https" ? mirror.githubTransport.tokenSourceRef : "")}`,
@@ -74,24 +81,36 @@ export function nodeRuntimeGitMirrorStatus(scoped: ReturnType<typeof parseNodeSc
     "deploy_ready() { desired=$(kubectl -n \"$1\" get deploy \"$2\" -o 'jsonpath={.spec.replicas}' 2>/dev/null || true); ready=$(kubectl -n \"$1\" get deploy \"$2\" -o 'jsonpath={.status.readyReplicas}' 2>/dev/null || true); [ -n \"$desired\" ] && [ \"$desired\" -gt 0 ] 2>/dev/null && [ \"${ready:-0}\" = \"$desired\" ] && printf true || printf false; }",
     "exists_res() { kubectl -n \"$1\" get \"$2\" \"$3\" >/dev/null 2>&1 && printf true || printf false; }",
     "endpoint_ready() { endpoints=$(kubectl -n \"$1\" get endpoints \"$2\" -o 'jsonpath={.subsets[*].addresses[*].ip}' 2>/dev/null || true); [ -n \"$endpoints\" ] && printf true || printf false; }",
-    "github_transport_json=$(python3 - \"$github_transport_mode\" \"$namespace\" \"$github_token_secret\" \"$github_token_key\" \"$github_token_source_ref\" \"$github_token_source_key\" <<'PY'",
+    "github_transport_json=$(python3 - \"$github_transport_mode\" \"$namespace\" \"$github_ssh_secret\" \"$github_ssh_private_key\" \"$github_ssh_private_source_ref\" \"$github_ssh_private_source_key\" \"$github_ssh_known_hosts_key\" \"$github_ssh_known_hosts_source_ref\" \"$github_ssh_known_hosts_source_key\" \"$github_token_secret\" \"$github_token_key\" \"$github_token_source_ref\" \"$github_token_source_key\" <<'PY'",
     "import hashlib, json, subprocess, sys",
-    "mode, namespace, secret_name, secret_key, source_ref, source_key = sys.argv[1:7]",
-    "if mode != 'https':",
-    "    print(json.dumps({'mode': mode, 'required': False, 'ready': True, 'valuesPrinted': False}))",
-    "    raise SystemExit(0)",
-    "proc = subprocess.run(['kubectl', '-n', namespace, 'get', 'secret', secret_name, '-o', 'json'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)",
-    "exists = proc.returncode == 0",
-    "data = {}",
-    "if exists:",
+    "mode, namespace, ssh_secret, ssh_private_key, ssh_private_source_ref, ssh_private_source_key, ssh_known_hosts_key, ssh_known_hosts_source_ref, ssh_known_hosts_source_key, token_secret, token_key, token_source_ref, token_source_key = sys.argv[1:14]",
+    "def read_secret(name):",
+    "    proc = subprocess.run(['kubectl', '-n', namespace, 'get', 'secret', name, '-o', 'json'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)",
+    "    if proc.returncode != 0:",
+    "        return False, {}, {}",
     "    try:",
-    "        data = json.loads(proc.stdout).get('data') or {}",
+    "        obj = json.loads(proc.stdout)",
     "    except Exception:",
-    "        data = {}",
-    "encoded = data.get(secret_key) if isinstance(data, dict) else None",
+    "        obj = {}",
+    "    return True, obj.get('data') or {}, obj.get('metadata', {}).get('annotations') or {}",
+    "def fingerprint(value):",
+    "    return 'sha256:' + hashlib.sha256(value.encode()).hexdigest()[:16] if value else None",
+    "if mode == 'ssh':",
+    "    exists, data, annotations = read_secret(ssh_secret)",
+    "    private_encoded = data.get(ssh_private_key) if isinstance(data, dict) else None",
+    "    known_hosts_encoded = data.get(ssh_known_hosts_key) if ssh_known_hosts_key and isinstance(data, dict) else None",
+    "    private_present = isinstance(private_encoded, str) and len(private_encoded) > 0",
+    "    known_hosts_expected = bool(ssh_known_hosts_key)",
+    "    known_hosts_present = isinstance(known_hosts_encoded, str) and len(known_hosts_encoded) > 0",
+    "    print(json.dumps({'mode': mode, 'required': True, 'ready': exists and private_present and (not known_hosts_expected or known_hosts_present), 'secretName': ssh_secret, 'privateKeySecretKey': ssh_private_key, 'privateKeySourceRef': ssh_private_source_ref, 'privateKeySourceKey': ssh_private_source_key, 'privateKeySecretExists': exists, 'privateKeyPresent': private_present, 'privateKeyBytes': len(private_encoded) if private_present else 0, 'privateKeyFingerprint': annotations.get('unidesk.ai/private-key-fingerprint') or fingerprint(private_encoded), 'knownHostsSecretKey': ssh_known_hosts_key or None, 'knownHostsSourceRef': ssh_known_hosts_source_ref or None, 'knownHostsSourceKey': ssh_known_hosts_source_key or None, 'knownHostsPresent': (known_hosts_present if known_hosts_expected else None), 'knownHostsBytes': (len(known_hosts_encoded) if known_hosts_present else 0) if known_hosts_expected else None, 'knownHostsFingerprint': annotations.get('unidesk.ai/known-hosts-fingerprint') or fingerprint(known_hosts_encoded), 'valuesPrinted': False}))",
+    "    raise SystemExit(0)",
+    "if mode != 'https':",
+    "    print(json.dumps({'mode': mode, 'required': True, 'ready': False, 'valuesPrinted': False}))",
+    "    raise SystemExit(0)",
+    "exists, data, _ = read_secret(token_secret)",
+    "encoded = data.get(token_key) if isinstance(data, dict) else None",
     "present = isinstance(encoded, str) and len(encoded) > 0",
-    "fingerprint = 'sha256:' + hashlib.sha256(encoded.encode()).hexdigest()[:16] if present else None",
-    "print(json.dumps({'mode': mode, 'required': True, 'ready': exists and present, 'tokenSecretName': secret_name, 'tokenSecretKey': secret_key, 'tokenSourceRef': source_ref, 'tokenSourceKey': source_key, 'tokenSecretExists': exists, 'tokenKeyPresent': present, 'tokenKeyBytes': len(encoded) if present else 0, 'tokenFingerprint': fingerprint, 'valuesPrinted': False}))",
+    "print(json.dumps({'mode': mode, 'required': True, 'ready': exists and present, 'tokenSecretName': token_secret, 'tokenSecretKey': token_key, 'tokenSourceRef': token_source_ref, 'tokenSourceKey': token_source_key, 'tokenSecretExists': exists, 'tokenKeyPresent': present, 'tokenKeyBytes': len(encoded) if present else 0, 'tokenFingerprint': fingerprint(encoded), 'valuesPrinted': False}))",
     "PY",
     ")",
     "summary_json=$(kubectl -n \"$namespace\" exec deploy/\"$read_deploy\" -- sh -lc '/etc/git-mirror/status.sh' 2>/tmp/hwlab-node-gitmirror-status.err || true)",

scripts/src/hwlab-node/web-probe.ts

@@ -1184,7 +1184,27 @@ export function nodeRuntimeGitMirrorTarget(spec: HwlabRuntimeLaneSpec): NodeRunt
 
 export function nodeRuntimeGitMirrorGithubTransportSpec(raw: Record<string, unknown>, path: string): NodeRuntimeGitMirrorGithubTransportSpec {
   const mode = stringValue(raw.mode, `${path}.mode`);
-  if (mode === "ssh") return { mode };
+  if (mode === "ssh") {
+    const knownHostsSecretKey = optionalStringValue(raw.knownHostsSecretKey, `${path}.knownHostsSecretKey`);
+    const knownHostsSourceRef = optionalStringValue(raw.knownHostsSourceRef, `${path}.knownHostsSourceRef`);
+    const knownHostsSourceKey = optionalStringValue(raw.knownHostsSourceKey, `${path}.knownHostsSourceKey`);
+    const knownHostsSourceEncoding = raw.knownHostsSourceEncoding === undefined ? null : gitMirrorSecretSourceEncoding(raw.knownHostsSourceEncoding, `${path}.knownHostsSourceEncoding`);
+    const knownHostsValues = [knownHostsSecretKey, knownHostsSourceRef, knownHostsSourceKey, knownHostsSourceEncoding];
+    if (knownHostsValues.some((value) => value !== null) && knownHostsValues.some((value) => value === null)) {
+      throw new Error(`${path}.knownHostsSecretKey/sourceRef/sourceKey/sourceEncoding must be declared together`);
+    }
+    return {
+      mode,
+      privateKeySecretKey: stringValue(raw.privateKeySecretKey, `${path}.privateKeySecretKey`),
+      privateKeySourceRef: stringValue(raw.privateKeySourceRef, `${path}.privateKeySourceRef`),
+      privateKeySourceKey: stringValue(raw.privateKeySourceKey, `${path}.privateKeySourceKey`),
+      privateKeySourceEncoding: gitMirrorSecretSourceEncoding(raw.privateKeySourceEncoding, `${path}.privateKeySourceEncoding`),
+      knownHostsSecretKey,
+      knownHostsSourceRef,
+      knownHostsSourceKey,
+      knownHostsSourceEncoding,
+    };
+  }
   if (mode !== "https") throw new Error(`${path}.mode must be ssh or https`);
   return {
     mode,
@@ -1196,6 +1216,12 @@ export function nodeRuntimeGitMirrorGithubTransportSpec(raw: Record<string, unkn
   };
 }
 
+function gitMirrorSecretSourceEncoding(raw: unknown, path: string): "plain" | "base64" {
+  const value = stringValue(raw, path);
+  if (value !== "plain" && value !== "base64") throw new Error(`${path} must be plain or base64`);
+  return value;
+}
+
 export function nodeRuntimeGitMirrorEgressProxySpec(raw: Record<string, unknown>, path: string): NodeRuntimeGitMirrorEgressProxySpec {
   const mode = stringValue(raw.mode, `${path}.mode`);
   if (mode !== "k8s-service-cluster-ip") throw new Error(`${path}.mode must be k8s-service-cluster-ip`);