mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: scope v03 secret-plane smoke to D601

Browse Source
This commit is contained in:
root
2026-06-27 13:33:45 +00:00
parent 367affeabb
commit aedc30c7c1
4 changed files with 122 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/gitops-render.mjs
+36 -5
View File
@@ -1292,6 +1292,7 @@ function mergeEnvMaps(...values) {
function runtimeNodeIdForProfile(deploy, profile, fallback = "node") {
if (!isRuntimeLane(profile)) return fallback;
if (typeof fallback === "string" && fallback.trim() && fallback !== "node") return fallback;
const nodeId = deploy?.lanes?.[profile]?.node;
return typeof nodeId === "string" && nodeId.length > 0 ? nodeId : fallback;
}
@@ -1357,7 +1358,7 @@ function upsertV02MetricsPort(service) {
service.spec.ports.push({ name: "metrics", port: 9100, targetPort: "metrics" });
}
function transformWorkloads({ workloads, deploy, catalog, source, sourceBranch = defaultBranch, gitReadUrl, registryPrefix, runtimeEndpoint, webEndpoint, profile = "dev", useDeployImages = false, metricsSidecarSha256 = null }) {
function transformWorkloads({ workloads, deploy, catalog, source, sourceBranch = defaultBranch, gitReadUrl, registryPrefix, runtimeEndpoint, webEndpoint, profile = "dev", nodeId = "node", useDeployImages = false, metricsSidecarSha256 = null }) {
const result = cloneJson(workloads);
const deployServices = deployServicesForProfile(deploy, profile);
const namespace = namespaceNameForProfile(profile);
@@ -1486,7 +1487,7 @@ function transformWorkloads({ workloads, deploy, catalog, source, sourceBranch =
applyServiceShutdownDrainLifecycle(container, deployService.shutdownDrain);
upsertEnv(container.env, "HWLAB_M3_IO_CONTROL_ENABLED", "false");
upsertEnv(container.env, "HWLAB_CODE_AGENT_AGENTRUN_REPO_URL", gitReadUrl ?? defaultRuntimeLaneGitReadUrl);
upsertEnv(container.env, "HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID", runtimeNodeIdForProfile(deploy, profile));
upsertEnv(container.env, "HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID", runtimeNodeIdForProfile(deploy, profile, nodeId));
upsertEnv(container.env, "HWLAB_OPENFGA_MODE", "enforce");
upsertEnv(container.env, "HWLAB_OPENFGA_API_URL", `http://hwlab-openfga.${namespace}.svc.cluster.local:8080`);
upsertEnvEntry(container.env, deployEnvEntry("HWLAB_OPENFGA_AUTHN_TOKEN", `secretRef:hwlab-${profile}-openfga/authn-preshared-key`, namespace, profile));
@@ -5521,7 +5522,7 @@ function runtimeConfigMapsManifest({ configMaps, namespace, labels, annotations
};
}
async function runtimeSecretPlaneConfigForProfile(deploy, profile) {
async function runtimeSecretPlaneConfigForProfile(deploy, profile, args = {}) {
if (!isRuntimeLane(profile)) return null;
const laneConfig = deploy?.lanes?.[profile];
const secretPlane = laneConfig?.secretPlaneRef
@@ -5529,9 +5530,39 @@ async function runtimeSecretPlaneConfigForProfile(deploy, profile) {
: laneConfig?.secretPlane;
if (!secretPlane || typeof secretPlane !== "object" || Array.isArray(secretPlane)) return null;
if (secretPlane.enabled !== true) return null;
if (!runtimeSecretPlaneEnabledForNode(secretPlane, args)) return null;
return cloneJson(secretPlane);
}
function runtimeSecretPlaneEnabledForNode(secretPlane, args = {}) {
const enabledOnNodes = normalizeSecretPlaneNodeList(secretPlane.enabledOnNodes, "secretPlane.enabledOnNodes");
if (enabledOnNodes.length === 0) return true;
const nodeId = effectiveSecretPlaneNodeId(args);
assert.ok(nodeId, "secretPlane.enabledOnNodes requires --node or a node-scoped --gitops-root");
return enabledOnNodes.includes(nodeId);
}
function normalizeSecretPlaneNodeList(value, label) {
if (value === undefined) return [];
assert.ok(Array.isArray(value), `${label} must be an array when set`);
return value.map((item, index) => {
assert.equal(typeof item, "string", `${label}[${index}] must be a string`);
const nodeId = item.trim().toUpperCase();
assert.ok(/^[A-Z0-9][A-Z0-9-]*$/u.test(nodeId), `${label}[${index}] must be a node id`);
return nodeId;
});
}
function effectiveSecretPlaneNodeId(args = {}) {
return gitopsRootNodeId(args.gitopsRoot) ?? String(args.nodeId ?? "").trim().toUpperCase();
}
function gitopsRootNodeId(gitopsRoot) {
const normalized = String(gitopsRoot ?? "").replaceAll("\\", "/").replace(/\/+$/u, "");
const match = normalized.match(/(?:^|\/)deploy\/gitops\/node\/([^/]+)$/u);
return match?.[1] ? match[1].trim().toUpperCase() : null;
}
function runtimeSecretPlaneManifest({ config, namespace, labels, annotations }) {
const store = config?.store;
assert.ok(store && typeof store === "object" && !Array.isArray(store), "secretPlane.store must be an object");
@@ -5744,7 +5775,7 @@ async function plannedFiles(args) {
const externalPostgres = externalPostgresConfigForLane(deploy, profile);
const workbenchRedis = workbenchRuntimeRedisConfigForProfile(deploy, profile);
const runtimeConfigMaps = runtimeConfigMapsForProfile(deploy, profile);
const runtimeSecretPlane = await runtimeSecretPlaneConfigForProfile(deploy, profile);
const runtimeSecretPlane = await runtimeSecretPlaneConfigForProfile(deploy, profile, args);
const profileLabels = { ...baseLabels, "hwlab.pikastech.local/environment": runtimeLabelForProfile(profile), "hwlab.pikastech.local/profile": runtimeLabelForProfile(profile) };
const runtimeNamespace = cloneJson(namespaceTemplate);
runtimeNamespace.metadata.name = namespace;
@@ -5759,7 +5790,7 @@ async function plannedFiles(args) {
putJson(`${runtimePath}/health-contract.yaml`, transformHealthContract(health, namespace, profileLabels, annotations, endpoints.runtimeEndpoint, endpoints.webEndpoint, profile));
if (runtimeConfigMaps.length > 0) putJson(`${runtimePath}/configmaps.yaml`, runtimeConfigMapsManifest({ configMaps: runtimeConfigMaps, namespace, labels: profileLabels, annotations }));
if (runtimeSecretPlane) putJson(`${runtimePath}/external-secrets.yaml`, runtimeSecretPlaneManifest({ config: runtimeSecretPlane, namespace, labels: profileLabels, annotations }));
putJson(`${runtimePath}/workloads.yaml`, transformWorkloads({ workloads, deploy, catalog: artifactCatalog, source, sourceBranch: args.sourceBranch, gitReadUrl: args.gitReadUrl, registryPrefix: args.registryPrefix, runtimeEndpoint: endpoints.runtimeEndpoint, webEndpoint: endpoints.webEndpoint, profile, useDeployImages: args.useDeployImages, metricsSidecarSha256 }));
putJson(`${runtimePath}/workloads.yaml`, transformWorkloads({ workloads, deploy, catalog: artifactCatalog, source, sourceBranch: args.sourceBranch, gitReadUrl: args.gitReadUrl, registryPrefix: args.registryPrefix, runtimeEndpoint: endpoints.runtimeEndpoint, webEndpoint: endpoints.webEndpoint, profile, nodeId: args.nodeId, useDeployImages: args.useDeployImages, metricsSidecarSha256 }));
putJson(`${runtimePath}/deepseek-proxy.yaml`, deepSeekProxyManifest({ profile, source, sourceBranch: args.sourceBranch, sourceRepo: args.sourceRepo, gitReadUrl: args.gitReadUrl, deploy, registryPrefix: args.registryPrefix, catalog: artifactCatalog, useDeployImages: args.useDeployImages, metricsSidecarSha256 }));
if (isRuntimeLane(profile) && externalPostgres) putJson(`${runtimePath}/external-postgres.yaml`, externalPostgresManifest({ profile, config: externalPostgres, source }));
if (isRuntimeLane(profile) && !externalPostgres) putJson(`${runtimePath}/postgres.yaml`, v02PostgresManifest({ profile, migrationSql, source, image: runtimePostgresImageForProfile(deploy, profile) }));