mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 隔离 Sub2Rank PaC 执行身份

Browse Source
This commit is contained in:
Codex
2026-07-13 08:12:47 +02:00
parent 18ac5d33ba
commit f99aefafbf
12 changed files with 201 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/native/cicd/pac-status-evaluator.cjs
+28
View File
@@ -112,6 +112,8 @@ function evaluatePacAdmissionState(inputValue) {
const role = record(input.role);
const roleBinding = record(input.roleBinding);
const expected = record(input.expected);
const executionServiceAccounts = Array.isArray(input.executionServiceAccounts) ? input.executionServiceAccounts.map(record) : [];
const expectedExecutionServiceAccounts = Array.isArray(expected.managedExecutionServiceAccounts) ? expected.managedExecutionServiceAccounts.map(record) : [];
const namespace = stringOrNull(input.namespace);
const policyMetadata = record(policy.metadata);
const bindingMetadata = record(binding.metadata);
@@ -167,6 +169,31 @@ function evaluatePacAdmissionState(inputValue) {
if (namespace === null || subjects.length !== 1 || subjects[0].kind !== "ServiceAccount" || subjects[0].name !== "default" || subjects[0].namespace !== namespace) reasons.push("default-rolebinding-subject-mismatch");
if (typeof input.defaultCanMutate !== "boolean") reasons.push("default-serviceaccount-mutation-probe-unavailable");
if (input.defaultCanMutate === true) reasons.push("default-serviceaccount-can-mutate-tekton-runs");
const executionServiceAccountState = expectedExecutionServiceAccounts.map((expectedServiceAccount) => {
const expectedNamespace = stringOrNull(expectedServiceAccount.namespace);
const expectedName = stringOrNull(expectedServiceAccount.name);
const expectedConsumerId = stringOrNull(expectedServiceAccount.consumerId);
const live = executionServiceAccounts.find((item) => {
const metadata = record(item.metadata);
return metadata.namespace === expectedNamespace && metadata.name === expectedName;
});
const metadata = record(live?.metadata);
const annotations = record(metadata.annotations);
const labels = record(metadata.labels);
const identity = expectedConsumerId || expectedName || "unknown";
if (live === undefined) reasons.push(`execution-serviceaccount-missing:${identity}`);
if (live !== undefined && live.automountServiceAccountToken !== false) reasons.push(`execution-serviceaccount-automount-not-false:${identity}`);
if (live !== undefined && annotations["unidesk.ai/effective-config-sha256"] !== expected.rbacConfigSha256) reasons.push(`execution-serviceaccount-config-sha256-mismatch:${identity}`);
if (live !== undefined && labels["unidesk.ai/pac-consumer"] !== expectedConsumerId) reasons.push(`execution-serviceaccount-consumer-mismatch:${identity}`);
return {
consumerId: expectedConsumerId,
namespace: expectedNamespace,
name: expectedName,
present: live !== undefined,
automountServiceAccountToken: live === undefined ? null : live.automountServiceAccountToken === false ? false : true,
configSha256: stringOrNull(annotations["unidesk.ai/effective-config-sha256"]),
};
});
const timestamps = [policyMetadata.creationTimestamp, bindingMetadata.creationTimestamp]
.filter((value) => typeof value === "string" && Number.isFinite(Date.parse(value)))
.sort((left, right) => Date.parse(left) - Date.parse(right));
@@ -189,6 +216,7 @@ function evaluatePacAdmissionState(inputValue) {
observedGeneration: Number.isInteger(policyStatus.observedGeneration) ? policyStatus.observedGeneration : null,
rbacConfigSha256: stringOrNull(roleAnnotations["unidesk.ai/effective-config-sha256"]),
defaultCanMutate: typeof input.defaultCanMutate === "boolean" ? input.defaultCanMutate : null,
executionServiceAccounts: executionServiceAccountState,
activeAfter,
reasons,
valuesPrinted: false,