From 94a1714ec5b66bd925cb0c1e03b036cadbb3bc8a Mon Sep 17 00:00:00 2001 From: pikastech Date: Mon, 20 Jul 2026 05:16:55 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20=E7=94=A8=20TCP=20connect=20=E9=AA=8C?= =?UTF-8?q?=E8=AF=81=20k3s=20ClusterIP?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/reference/platform-infra.md | 2 +- scripts/src/platform-infra-k3s-cluster.ts | 7 +------ 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/docs/reference/platform-infra.md b/docs/reference/platform-infra.md index 31a487f9..9186c214 100644 --- a/docs/reference/platform-infra.md +++ b/docs/reference/platform-infra.md @@ -52,7 +52,7 @@ - `status` 必须同时证明 WireGuard handshake、worker host proxy、server/agent systemd、两个 Ready node、worker InternalIP 和旧 server 退役。 - `smoke --confirm` 必须把 Job 定向调度到 worker，并验证集群 DNS 和 Kubernetes ClusterIP；成功后删除 Job。 - smoke 等待必须使用短 `kubectl get` 轮询，禁止让单次 `trans` 挂住等待 Job 条件。 - - smoke 访问 Kubernetes API 必须使用 Pod 挂载的 ServiceAccount token 与 CA，不能依赖匿名 `/healthz`。 + - 基础 smoke 通过完整服务 FQDN 和 Kubernetes API `ClusterIP:443` TCP connect 验证 DNS 与 Service 数据面，不把容器 TLS 客户端能力混入判定。 - Secret 输出只显示 sourceRef、presence、key 名和 fingerprint，不显示值。 ## Hyper-V Ubuntu Provider VM diff --git a/scripts/src/platform-infra-k3s-cluster.ts b/scripts/src/platform-infra-k3s-cluster.ts index dbdd2ddd..89d080da 100644 --- a/scripts/src/platform-infra-k3s-cluster.ts +++ b/scripts/src/platform-infra-k3s-cluster.ts @@ -468,12 +468,7 @@ spec: - -ec - | nslookup kubernetes.default.svc.cluster.local. - token="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" - wget -qO- \ - --no-check-certificate \ - --header="Authorization: Bearer $token" \ - --timeout=15 \ - "https://\${KUBERNETES_SERVICE_HOST}:\${KUBERNETES_SERVICE_PORT_HTTPS}/healthz" | grep -q '^ok$' + nc -z -w 15 "\${KUBERNETES_SERVICE_HOST}" "\${KUBERNETES_SERVICE_PORT_HTTPS}" echo D601_RUNTIME_SMOKE_OK `; }