feat: add v03 secret-plane smoke sync

2026-06-27 18:00:05 +08:00
parent 6120f7fdfe
commit 4964cdde5f
4 changed files with 124 additions and 2 deletions
@@ -5521,10 +5521,88 @@ function runtimeConfigMapsManifest({ configMaps, namespace, labels, annotations
  };
 }

-function runtimeKustomization({ profile = "dev", includeDeviceAgent = profile === "dev", externalPostgres = false, workbenchRedis = false, runtimeConfigMaps = false } = {}) {
+async function runtimeSecretPlaneConfigForProfile(deploy, profile) {
+  if (!isRuntimeLane(profile)) return null;
+  const laneConfig = deploy?.lanes?.[profile];
+  const secretPlane = laneConfig?.secretPlaneRef
+    ? await readConfigRef(laneConfig.secretPlaneRef, `${profile}.secretPlaneRef`)
+    : laneConfig?.secretPlane;
+  if (!secretPlane || typeof secretPlane !== "object" || Array.isArray(secretPlane)) return null;
+  if (secretPlane.enabled !== true) return null;
+  return cloneJson(secretPlane);
+}
+
+function runtimeSecretPlaneManifest({ config, namespace, labels, annotations }) {
+  const store = config?.store;
+  assert.ok(store && typeof store === "object" && !Array.isArray(store), "secretPlane.store must be an object");
+  assert.equal(store.kind, "ClusterSecretStore", "secretPlane.store.kind must be ClusterSecretStore for D601/v0.3");
+  assert.ok(typeof store.name === "string" && store.name.trim(), "secretPlane.store.name must be set");
+  const secrets = Array.isArray(config.secrets) ? config.secrets : [];
+  assert.ok(secrets.length > 0, "secretPlane.secrets must not be empty");
+  return {
+    apiVersion: "v1",
+    kind: "List",
+    items: secrets.map((secret, index) => runtimeSecretPlaneExternalSecret({ config, secret, index, namespace, labels, annotations, store }))
+  };
+}
+
+function runtimeSecretPlaneExternalSecret({ config, secret, index, namespace, labels, annotations, store }) {
+  const externalSecretName = requiredSecretPlaneString(secret?.externalSecretName, `secretPlane.secrets[${index}].externalSecretName`);
+  const targetSecretName = requiredSecretPlaneString(secret?.targetSecretName, `secretPlane.secrets[${index}].targetSecretName`);
+  const data = Array.isArray(secret?.data) ? secret.data : [];
+  assert.ok(data.length > 0, `secretPlane.secrets[${index}].data must not be empty`);
+  const sourceRefs = data.map((item) => requiredSecretPlaneString(item?.remoteRef, `secretPlane.secrets[${index}].data.remoteRef`));
+  return {
+    apiVersion: "external-secrets.io/v1",
+    kind: "ExternalSecret",
+    metadata: {
+      name: externalSecretName,
+      namespace,
+      labels: {
+        ...labels,
+        "app.kubernetes.io/name": externalSecretName,
+        "app.kubernetes.io/component": "external-secret",
+        "hwlab.pikastech.local/secret-plane": String(config.issue ?? "pikasTech/HWLAB#2234")
+      },
+      annotations: {
+        ...annotations,
+        "hwlab.pikastech.local/source-ref": sourceRefs.join(","),
+        "hwlab.pikastech.local/values-printed": "false"
+      }
+    },
+    spec: {
+      refreshInterval: requiredSecretPlaneString(config.refreshInterval, "secretPlane.refreshInterval"),
+      secretStoreRef: {
+        name: requiredSecretPlaneString(store.name, "secretPlane.store.name"),
+        kind: store.kind
+      },
+      target: {
+        name: targetSecretName,
+        creationPolicy: "Owner"
+      },
+      data: data.map((item, itemIndex) => ({
+        secretKey: requiredSecretPlaneString(item?.targetKey, `secretPlane.secrets[${index}].data[${itemIndex}].targetKey`),
+        remoteRef: {
+          key: requiredSecretPlaneString(item?.remoteRef, `secretPlane.secrets[${index}].data[${itemIndex}].remoteRef`),
+          property: requiredSecretPlaneString(item?.property, `secretPlane.secrets[${index}].data[${itemIndex}].property`)
+        }
+      }))
+    }
+  };
+}
+
+function requiredSecretPlaneString(value, label) {
+  assert.equal(typeof value, "string", `${label} must be a string`);
+  const trimmed = value.trim();
+  assert.ok(trimmed, `${label} must not be empty`);
+  return trimmed;
+}
+
+function runtimeKustomization({ profile = "dev", includeDeviceAgent = profile === "dev", externalPostgres = false, workbenchRedis = false, runtimeConfigMaps = false, externalSecrets = false } = {}) {
  const resources = ["namespace.yaml", "services.yaml", "health-contract.yaml", "workloads.yaml", "deepseek-proxy.yaml"];
  if (!isRuntimeLane(profile)) resources.splice(1, 0, "code-agent-codex-config.yaml");
  if (runtimeConfigMaps) resources.splice(3, 0, "configmaps.yaml");
+  if (externalSecrets) resources.splice(resources.indexOf("workloads.yaml"), 0, "external-secrets.yaml");
  if (isRuntimeLane(profile)) {
    if (externalPostgres) resources.push("external-postgres.yaml");
    else resources.push("postgres.yaml");
@@ -5666,6 +5744,7 @@ async function plannedFiles(args) {
    const externalPostgres = externalPostgresConfigForLane(deploy, profile);
    const workbenchRedis = workbenchRuntimeRedisConfigForProfile(deploy, profile);
    const runtimeConfigMaps = runtimeConfigMapsForProfile(deploy, profile);
+    const runtimeSecretPlane = await runtimeSecretPlaneConfigForProfile(deploy, profile);
    const profileLabels = { ...baseLabels, "hwlab.pikastech.local/environment": runtimeLabelForProfile(profile), "hwlab.pikastech.local/profile": runtimeLabelForProfile(profile) };
    const runtimeNamespace = cloneJson(namespaceTemplate);
    runtimeNamespace.metadata.name = namespace;
@@ -5673,12 +5752,13 @@ async function plannedFiles(args) {
    annotate(runtimeNamespace.metadata, annotations);
    const runtimePath = runtimePathForProfile(profile);
    const endpoints = profileEndpoint(args, profile);
-    putJson(`${runtimePath}/kustomization.yaml`, runtimeKustomization({ profile, includeDeviceAgent, externalPostgres: Boolean(externalPostgres), workbenchRedis: Boolean(workbenchRedis), runtimeConfigMaps: runtimeConfigMaps.length > 0 }));
+    putJson(`${runtimePath}/kustomization.yaml`, runtimeKustomization({ profile, includeDeviceAgent, externalPostgres: Boolean(externalPostgres), workbenchRedis: Boolean(workbenchRedis), runtimeConfigMaps: runtimeConfigMaps.length > 0, externalSecrets: Boolean(runtimeSecretPlane) }));
    putJson(`${runtimePath}/namespace.yaml`, runtimeNamespace);
    if (!isRuntimeLane(profile)) putJson(`${runtimePath}/code-agent-codex-config.yaml`, transformListNamespace(config, namespace, profileLabels, annotations));
    putJson(`${runtimePath}/services.yaml`, transformServices({ services, namespace, labels: profileLabels, annotations, profile, deploy }));
    putJson(`${runtimePath}/health-contract.yaml`, transformHealthContract(health, namespace, profileLabels, annotations, endpoints.runtimeEndpoint, endpoints.webEndpoint, profile));
    if (runtimeConfigMaps.length > 0) putJson(`${runtimePath}/configmaps.yaml`, runtimeConfigMapsManifest({ configMaps: runtimeConfigMaps, namespace, labels: profileLabels, annotations }));
+    if (runtimeSecretPlane) putJson(`${runtimePath}/external-secrets.yaml`, runtimeSecretPlaneManifest({ config: runtimeSecretPlane, namespace, labels: profileLabels, annotations }));
    putJson(`${runtimePath}/workloads.yaml`, transformWorkloads({ workloads, deploy, catalog: artifactCatalog, source, sourceBranch: args.sourceBranch, gitReadUrl: args.gitReadUrl, registryPrefix: args.registryPrefix, runtimeEndpoint: endpoints.runtimeEndpoint, webEndpoint: endpoints.webEndpoint, profile, useDeployImages: args.useDeployImages, metricsSidecarSha256 }));
    putJson(`${runtimePath}/deepseek-proxy.yaml`, deepSeekProxyManifest({ profile, source, sourceBranch: args.sourceBranch, sourceRepo: args.sourceRepo, gitReadUrl: args.gitReadUrl, deploy, registryPrefix: args.registryPrefix, catalog: artifactCatalog, useDeployImages: args.useDeployImages, metricsSidecarSha256 }));
    if (isRuntimeLane(profile) && externalPostgres) putJson(`${runtimePath}/external-postgres.yaml`, externalPostgresManifest({ profile, config: externalPostgres, source }));