Merge pull request #2807 from pikasTech/fix/2803-2804-pac-blockers

修复 NC01 PaC 发布的旧 PVC 与 Gitea 认证阻塞

.tekton/platform-infra-gitea-nc01-pac.yaml

@@ -28,6 +28,12 @@ spec:
             - name: workspace
               emptyDir:
                 sizeLimit: 2Gi
+            - name: gitea-auth
+              secret:
+                secretName: "{{gitops_secret_name}}"
+                items:
+                  - key: token
+                    path: token
           steps:
             - name: publish
               image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
@@ -41,6 +47,18 @@ spec:
               script: |
                 #!/bin/sh
                 set -eu
+                askpass=/workspace/gitea-askpass.sh
+                trap 'rm -f "$askpass"' EXIT
+                cat >"$askpass" <<'ASKPASS'
+                #!/bin/sh
+                case "$1" in
+                  *Username*) printf '%s\n' "${GITEA_USERNAME:?}" ;;
+                  *Password*) cat /workspace/gitea-auth/token ;;
+                  *) exit 1 ;;
+                esac
+                ASKPASS
+                chmod 700 "$askpass"
+                export GITEA_USERNAME="{{gitops_username}}" GIT_ASKPASS="$askpass" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0
                 rm -rf source platform-infra-gitea-gitops
                 git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git source
                 cd source
@@ -54,6 +72,9 @@ spec:
               volumeMounts:
                 - name: workspace
                   mountPath: /workspace
+                - name: gitea-auth
+                  mountPath: /workspace/gitea-auth
+                  readOnly: true
             - name: reconcile-public-edge
               image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
               imagePullPolicy: IfNotPresent

.tekton/web-probe-sentinel-nc01-pac.yaml

@@ -26,13 +26,12 @@ spec:
       - name: publish
         taskSpec:
           volumes:
-            - name: cache
+            - name: gitea-auth
-              persistentVolumeClaim:
-                claimName: hwlab-git-mirror-cache
-            - name: git-ssh
               secret:
-                secretName: git-mirror-github-ssh
+                secretName: "{{gitops_secret_name}}"
-                defaultMode: 256
+                items:
+                  - key: token
+                    path: token
             - name: workspace
               emptyDir:
                 sizeLimit: 8Gi
@@ -79,9 +78,6 @@ spec:
               volumeMounts:
                 - name: workspace
                   mountPath: /workspace
-                - name: git-ssh
-                  mountPath: /git-ssh
-                  readOnly: true
             - name: prepare-buildkit-state
               image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
               imagePullPolicy: IfNotPresent
@@ -119,14 +115,17 @@ spec:
             - name: publish
               image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
               imagePullPolicy: IfNotPresent
+              env:
+                - name: GITOPS_READ_URL
+                  value: "{{gitops_read_url}}"
+                - name: GITOPS_USERNAME
+                  value: "{{gitops_username}}"
               script: |
                 #!/bin/sh
                 exec /workspace/generated/publish.sh
               volumeMounts:
                 - name: workspace
                   mountPath: /workspace
-                - name: cache
+                - name: gitea-auth
-                  mountPath: /cache
+                  mountPath: /workspace/gitea-auth
-                - name: git-ssh
-                  mountPath: /git-ssh
                   readOnly: true

config/platform-infra/pipelines-as-code.yaml

@@ -547,6 +547,9 @@ consumers:
     deliveryObservation:
       runtimeEvidence: not-applicable
     closeoutGitOpsMirrorFlush: false
+    params:
+      gitops_username: unidesk-admin
+      gitops_secret_name: pac-gitea-sentinel-nc01-v03
   - id: platform-infra-sub2rank-nc01
     repositoryRef: sub2rank-nc01
     node: NC01
@@ -1020,6 +1023,9 @@ templates:
         sentinel_id: "${nodeLower}-web-probe-sentinel"
         image_repository: "127.0.0.1:5000/hwlab/web-probe-sentinel-${nodeLower}"
         registry_probe_base: http://127.0.0.1:5000
+        gitops_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-HWLAB.git
+        gitops_username: unidesk-admin
+        gitops_secret_name: "pac-gitea-sentinel-${nodeLower}-v03"
         gitops_branch: v0.3-gitops
         gitops_manifest_path: "deploy/gitops/node/${nodeLower}/web-probe-sentinel/web-probe-sentinel.yaml"
         pipeline_name: "hwlab-web-probe-sentinel-${nodeLower}-pac"

scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts

@@ -802,8 +802,9 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string,
     `job_name=${shellQuote(jobName)}`,
     `image_ref=${shellQuote(state.image.ref)}`,
     `image_repository=${shellQuote(state.image.repository)}`,
-    `gitops_repository=${shellQuote(stringAt(state.controlPlaneTarget, "source.repository"))}`,
     `gitops_branch=${shellQuote(stringAt(state.cicd, "argo.targetRevision"))}`,
+    "gitops_read_url=${GITOPS_READ_URL:?GITOPS_READ_URL is required}",
+    "gitops_username=${GITOPS_USERNAME:?GITOPS_USERNAME is required}",
     `files_b64=${shellQuote(filesB64)}`,
     "meta_dir=/workspace/meta",
     "event_log=/workspace/publish-events.log",
@@ -814,10 +815,17 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string,
     "emit_failed() { code=$?; if [ \"$code\" -ne 0 ]; then trace_id=$(printf '%s' \"${TRACEPARENT:-}\" | cut -d- -f2); printf '{\"ok\":false,\"status\":\"failed\",\"traceId\":\"%s\",\"firstBreak\":{\"code\":\"child-process-exit-nonzero\",\"phase\":\"%s\",\"reason\":\"GitOps publish command exited non-zero\",\"valuesRedacted\":true},\"error\":{\"type\":\"ChildProcessError\",\"code\":\"EXIT_NONZERO\",\"phase\":\"%s\",\"exitCode\":%s,\"stderrSummary\":\"bounded step logs contain the command failure\",\"valuesRedacted\":true},\"exitCode\":%s,\"jobName\":\"%s\",\"valuesRedacted\":true}\\n' \"$trace_id\" \"${current_phase:-gitops-publish}\" \"${current_phase:-gitops-publish}\" \"$code\" \"$code\" \"$job_name\"; fi; exit \"$code\"; }",
     "trap emit_failed EXIT",
     "if [ -f \"$event_log\" ]; then cat \"$event_log\"; fi",
-    "mkdir -p /root/.ssh",
+    "askpass=/workspace/gitea-askpass.sh",
-    "cp /git-ssh/ssh-privatekey /root/.ssh/id_rsa",
+    "cat >\"$askpass\" <<'ASKPASS'",
-    "chmod 0400 /root/.ssh/id_rsa",
+    "#!/bin/sh",
-    "export GIT_SSH_COMMAND='ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1'",
+    "case \"$1\" in",
+    "  *Username*) printf '%s\\n' \"${GITEA_USERNAME:?}\" ;;",
+    "  *Password*) cat /workspace/gitea-auth/token ;;",
+    "  *) exit 1 ;;",
+    "esac",
+    "ASKPASS",
+    "chmod 700 \"$askpass\"",
+    "export GITEA_USERNAME=\"$gitops_username\" GIT_ASKPASS=\"$askpass\" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0",
     "started_ms=$(read_meta started_ms)",
     "source_commit=$(read_meta source_commit)",
     "source_stage_ref=$(read_meta source_stage_ref)",
@@ -852,9 +860,8 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string,
     "gitops_started_ms=$(now_ms)",
     "if [ \"$files_b64\" != \"W10=\" ]; then",
     "  emit_stage gitops running \"$gitops_started_ms\"",
-    "  gitops_cache=\"/cache/${gitops_repository}.git\"",
     "  gitops_worktree=\"/tmp/$job_name/gitops\"",
-    "  git clone --no-checkout \"$gitops_cache\" \"$gitops_worktree\"",
+    "  git clone --no-checkout \"$gitops_read_url\" \"$gitops_worktree\"",
     "  cd \"$gitops_worktree\"",
     "  git fetch origin \"$gitops_branch\" || true",
     "  if git rev-parse --verify \"refs/remotes/origin/$gitops_branch^{commit}\" >/dev/null 2>&1; then git checkout -B \"$gitops_branch\" \"refs/remotes/origin/$gitops_branch\"; else git checkout --orphan \"$gitops_branch\"; git rm -rf . >/dev/null 2>&1 || true; fi",