mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add admin secrets read-only MVP

Browse Source
This commit is contained in:
root
2026-06-30 09:04:30 +00:00
parent 797e1ef107
commit 207dcc5dc6
12 changed files with 1333 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/gitops-render.test.ts
+13 -13
View File
@@ -582,7 +582,7 @@ test("v03 render keeps node identity as data instead of generated structure", as
"scripts/run-bun.mjs",
"scripts/gitops-render.mjs",
"--lane", "v03",
"--node", "D518",
"--node", "JD01",
"--catalog-path", staleCatalogPath,
"--image-tag-mode", "full",
"--source-branch", "v0.3",
@@ -617,8 +617,8 @@ test("v03 render keeps node identity as data instead of generated structure", as
const smokeExternalSecret = (externalSecretsJson.items ?? []).find((item) => item.kind === "ExternalSecret" && item.metadata?.name === "hwlab-secret-plane-smoke");
assert.ok(smokeExternalSecret, "expected v03 secret-plane smoke ExternalSecret");
assert.equal(smokeExternalSecret.metadata?.namespace, "hwlab-v03");
assert.equal(smokeExternalSecret.metadata?.labels?.["hwlab.pikastech.local/secret-plane"], "issue-2234");
assert.equal(smokeExternalSecret.metadata?.annotations?.["hwlab.pikastech.local/secret-plane-issue"], "pikasTech/HWLAB#2234");
assert.equal(smokeExternalSecret.metadata?.labels?.["hwlab.pikastech.local/secret-plane"], "issue-2277");
assert.equal(smokeExternalSecret.metadata?.annotations?.["hwlab.pikastech.local/secret-plane-issue"], "pikasTech/HWLAB#2277");
assert.equal(smokeExternalSecret.spec?.secretStoreRef?.kind, "ClusterSecretStore");
assert.equal(smokeExternalSecret.spec?.secretStoreRef?.name, "hwlab-secret-plane-vault-cluster");
assert.equal(smokeExternalSecret.spec?.target?.name, "hwlab-secret-plane-smoke");
@@ -665,7 +665,7 @@ test("v03 render keeps node identity as data instead of generated structure", as
.flatMap((container) => container.env ?? [])
.filter((entry) => entry.name === "HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID");
assert.ok(agentRunNodeEnv.length > 0, "expected AgentRun provider id env to carry configured node id");
assert.deepEqual([...new Set(agentRunNodeEnv.map((entry) => entry.value))], ["D518"]);
assert.deepEqual([...new Set(agentRunNodeEnv.map((entry) => entry.value))], ["JD01"]);
} finally {
await rm(outDir, { recursive: true, force: true });
@@ -673,9 +673,9 @@ test("v03 render keeps node identity as data instead of generated structure", as
}
});
test("v03 render includes D518 secret-plane smoke on D518 gitops root", async () => {
const outDir = await mkdtemp(path.join(os.tmpdir(), "hwlab-v03-d518-render-test-"));
const scratchDir = path.join(".tmp", `gitops-render-v03-d518-${process.pid}-${Date.now()}`);
test("v03 render includes JD01 secret-plane smoke on JD01 gitops root", { timeout: 20000 }, async () => {
const outDir = await mkdtemp(path.join(os.tmpdir(), "hwlab-v03-jd01-render-test-"));
const scratchDir = path.join(".tmp", `gitops-render-v03-jd01-${process.pid}-${Date.now()}`);
const staleCatalogPath = path.join(scratchDir, "artifact-catalog.v03.json");
try {
const staleRevision = "0".repeat(40);
@@ -714,7 +714,7 @@ test("v03 render includes D518 secret-plane smoke on D518 gitops root", async ()
"--image-tag-mode", "full",
"--source-branch", "v0.3",
"--gitops-branch", "v0.3-gitops",
"--gitops-root", "deploy/gitops/node/d518",
"--gitops-root", "deploy/gitops/node/jd01",
"--out", outDir,
"--source-revision", "HEAD"
], { cwd: process.cwd(), encoding: "utf8" });
@@ -730,10 +730,10 @@ test("v03 render includes D518 secret-plane smoke on D518 gitops root", async ()
assert.match(kustomization, /external-secrets\.yaml/u);
const externalSecretsJson = JSON.parse(await readFile(path.join(outDir, "runtime-v03", "external-secrets.yaml"), "utf8"));
const smokeExternalSecret = (externalSecretsJson.items ?? []).find((item) => item.kind === "ExternalSecret" && item.metadata?.name === "hwlab-secret-plane-smoke");
assert.ok(smokeExternalSecret, "expected D518 v03 secret-plane smoke ExternalSecret");
assert.ok(smokeExternalSecret, "expected JD01 v03 secret-plane smoke ExternalSecret");
assert.equal(smokeExternalSecret.metadata?.namespace, "hwlab-v03");
assert.equal(smokeExternalSecret.metadata?.labels?.["hwlab.pikastech.local/secret-plane"], "issue-2234");
assert.equal(smokeExternalSecret.metadata?.annotations?.["hwlab.pikastech.local/secret-plane-issue"], "pikasTech/HWLAB#2234");
assert.equal(smokeExternalSecret.metadata?.labels?.["hwlab.pikastech.local/secret-plane"], "issue-2277");
assert.equal(smokeExternalSecret.metadata?.annotations?.["hwlab.pikastech.local/secret-plane-issue"], "pikasTech/HWLAB#2277");
assert.equal(smokeExternalSecret.spec?.secretStoreRef?.kind, "ClusterSecretStore");
assert.equal(smokeExternalSecret.spec?.secretStoreRef?.name, "hwlab-secret-plane-vault-cluster");
assert.equal(smokeExternalSecret.spec?.target?.name, "hwlab-secret-plane-smoke");
@@ -748,8 +748,8 @@ test("v03 render includes D518 secret-plane smoke on D518 gitops root", async ()
.flatMap((item) => collectContainersFromItem(item))
.flatMap((container) => container.env ?? [])
.filter((entry) => entry.name === "HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID");
assert.ok(agentRunNodeEnv.length > 0, "expected D518 node id to be inferred from gitops root");
assert.deepEqual([...new Set(agentRunNodeEnv.map((entry) => entry.value))], ["D518"]);
assert.ok(agentRunNodeEnv.length > 0, "expected JD01 node id to be inferred from gitops root");
assert.deepEqual([...new Set(agentRunNodeEnv.map((entry) => entry.value))], ["JD01"]);
const opencode = JSON.parse(await readFile(path.join(outDir, "runtime-v03", "opencode.yaml"), "utf8"));
const opencodeDeployment = (opencode.items ?? []).find((item) => item.kind === "Deployment" && item.metadata?.name === "opencode-server");