mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(gitops): allow direct ssh git mirror egress (#2034)

Browse Source 
* fix(workbench): keep sealed turn timing immutable

* fix(gitops): allow direct ssh git mirror egress
This commit is contained in:
Lyon
2026-06-24 09:47:11 +08:00
committed by GitHub
parent 8274a31f37
commit 7d80770e40
1 changed files with 25 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/gitops-render.mjs
+25 -9
View File
@@ -3797,7 +3797,9 @@ function devopsInfraGitMirrorManifest(args, deploy) {
const laneConfig = configObject(configObject(deploy.lanes, "deploy.lanes")[args.lane], `deploy.lanes.${args.lane}`);
const gitMirrorConfig = configObject(laneConfig.gitMirror, `deploy.lanes.${args.lane}.gitMirror`);
const gitMirrorProxy = configObject(gitMirrorConfig.egressProxy, `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
assert.equal(gitMirrorProxy.mode, "node-global", `deploy.lanes.${args.lane}.gitMirror.egressProxy.mode must be node-global`);
const gitMirrorProxyMode = requiredConfigString(gitMirrorProxy, "mode", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
assert.ok(gitMirrorProxyMode === "node-global" || gitMirrorProxyMode === "direct", `deploy.lanes.${args.lane}.gitMirror.egressProxy.mode must be node-global or direct`);
const useDirectGitMirrorProxy = gitMirrorProxyMode === "direct";
const gitMirrorNamespace = requiredConfigString(gitMirrorConfig, "namespace", `deploy.lanes.${args.lane}.gitMirror`);
const gitMirrorReadName = requiredConfigString(gitMirrorConfig, "serviceReadName", `deploy.lanes.${args.lane}.gitMirror`);
const gitMirrorWriteName = requiredConfigString(gitMirrorConfig, "serviceWriteName", `deploy.lanes.${args.lane}.gitMirror`);
@@ -3806,16 +3808,29 @@ function devopsInfraGitMirrorManifest(args, deploy) {
const gitMirrorCacheHostPath = optionalConfigString(gitMirrorConfig, "cacheHostPath", `deploy.lanes.${args.lane}.gitMirror`);
const gitMirrorServicePort = requiredConfigPositiveInteger(gitMirrorConfig, "servicePort", `deploy.lanes.${args.lane}.gitMirror`);
const gitMirrorConfigMapName = requiredConfigString(gitMirrorConfig, "syncConfigMapName", `deploy.lanes.${args.lane}.gitMirror`);
const proxyNamespace = requiredConfigString(gitMirrorProxy, "namespace", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
const proxyServiceName = requiredConfigString(gitMirrorProxy, "serviceName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
const proxyPort = requiredConfigPositiveInteger(gitMirrorProxy, "port", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
const proxyClientName = requiredConfigString(gitMirrorProxy, "clientName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
const proxyNoProxy = Array.isArray(gitMirrorProxy.noProxy) ? gitMirrorProxy.noProxy.filter((value) => typeof value === "string" && value.length > 0).join(",") : "";
const proxyNamespace = useDirectGitMirrorProxy ? "" : requiredConfigString(gitMirrorProxy, "namespace", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
const proxyServiceName = useDirectGitMirrorProxy ? "" : requiredConfigString(gitMirrorProxy, "serviceName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
const proxyPort = useDirectGitMirrorProxy ? 0 : requiredConfigPositiveInteger(gitMirrorProxy, "port", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
const proxyClientName = useDirectGitMirrorProxy ? "" : requiredConfigString(gitMirrorProxy, "clientName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
const proxyNoProxy = !useDirectGitMirrorProxy && Array.isArray(gitMirrorProxy.noProxy) ? gitMirrorProxy.noProxy.filter((value) => typeof value === "string" && value.length > 0).join(",") : "";
const proxyHost = `${proxyServiceName}.${proxyNamespace}.svc.cluster.local`;
const proxyUrl = `http://${proxyHost}:${proxyPort}`;
const proxySummary = `git-mirror-egress-proxy client=${proxyClientName} mode=node-global required=true host=${proxyHost} port=${proxyPort} ssh=GIT_SSH-wrapper source=yaml`;
const proxyCommand = `ProxyCommand=node /tmp/hwlab-github-proxy-connect.mjs ${proxyHost} ${proxyPort} %h %p`;
const gitMirrorSshPrelude = `printf '%s\\n' ${shellSingleQuote(proxySummary)} >&2
const proxySummary = useDirectGitMirrorProxy
? "git-mirror-egress-proxy mode=direct required=false transport=ssh source=yaml"
: `git-mirror-egress-proxy client=${proxyClientName} mode=node-global required=true host=${proxyHost} port=${proxyPort} ssh=GIT_SSH-wrapper source=yaml`;
const proxyCommand = useDirectGitMirrorProxy ? "" : `ProxyCommand=node /tmp/hwlab-github-proxy-connect.mjs ${proxyHost} ${proxyPort} %h %p`;
const directGitMirrorSshPrelude = `printf '%s\\n' ${shellSingleQuote(proxySummary)} >&2
cat > /tmp/hwlab-git-ssh-proxy.sh <<'SH_PROXY'
#!/bin/sh
exec ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1 "$@"
SH_PROXY
chmod 0700 /tmp/hwlab-git-ssh-proxy.sh
unset HTTP_PROXY HTTPS_PROXY ALL_PROXY http_proxy https_proxy all_proxy
export NO_PROXY='*'
export no_proxy='*'
export GIT_SSH=/tmp/hwlab-git-ssh-proxy.sh
unset GIT_SSH_COMMAND`;
const proxiedGitMirrorSshPrelude = `printf '%s\\n' ${shellSingleQuote(proxySummary)} >&2
cat > /tmp/hwlab-github-proxy-connect.mjs <<'NODE_PROXY'
#!/usr/bin/env node
import net from "node:net";
@@ -3882,6 +3897,7 @@ export NO_PROXY=${shellSingleQuote(proxyNoProxy)}
export no_proxy=${shellSingleQuote(proxyNoProxy)}
export GIT_SSH=/tmp/hwlab-git-ssh-proxy.sh
unset GIT_SSH_COMMAND`;
const gitMirrorSshPrelude = useDirectGitMirrorProxy ? directGitMirrorSshPrelude : proxiedGitMirrorSshPrelude;
const cacheVolume = gitMirrorCacheHostPath === null
? { name: "cache", persistentVolumeClaim: { claimName: gitMirrorCachePvcName } }
: { name: "cache", hostPath: { path: gitMirrorCacheHostPath, type: "DirectoryOrCreate" } };