Lemon-miaow
adf563ffe3
复用现有 k3s 调度和 Job 生命周期，增加 worker 接入与批准、受保护节点身份、归档传输、持久迁移锁及活动 PVC 切换；同步管理员 API、CLI、面板和隔离规则。分布式模式默认关闭，保持单机兼容。 验证：Go 全量测试与 vet；面板 874 个测试、lint/build；Linux VM 安装器测试、清单服务端 dry-run、网络命名空间防火墙实测。A/B/C 三机 WireGuard、Velocity 和迁移验收仍待完成。
40 lines
1.4 KiB
Go
40 lines
1.4 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"os/exec"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestDistributedFirewallPathsAndSyntax(t *testing.T) {
|
|
for _, controller := range []bool{false, true} {
|
|
args := []string{"--dry-run", "--peers", "192.0.2.1/32,192.0.2.2/32", "--controller-ip", "192.0.2.1"}
|
|
if controller {
|
|
args = append(args, "--controller")
|
|
}
|
|
var out, err bytes.Buffer
|
|
if code := nodeFirewall(args, &out, &err); code != 0 {
|
|
t.Fatal(code, err.String())
|
|
}
|
|
script := out.String()
|
|
for _, must := range []string{"-I INPUT 1 -j FELIS-HOST", "-I FORWARD 1 -j FELIS-FORWARD", "-t raw -I PREROUTING 1 -j FELIS-NODEPORT", "-A FELIS-HOST -s 10.42.0.0/16 -j DROP", "--dst-type LOCAL -p tcp --dport 30443 -j DROP", "-d 169.254.0.0/16 -j DROP", "--dst-type LOCAL -p tcp --syn -j DROP", "-d 10.43.0.1 -p tcp --dport 443 --syn -j DROP"} {
|
|
if !strings.Contains(script, must) {
|
|
t.Fatal("missing protection", must)
|
|
}
|
|
}
|
|
if !controller && strings.Contains(script, " -p tcp --dport 6443 -j RETURN") {
|
|
t.Fatal("worker exposed apiserver")
|
|
}
|
|
check := exec.Command("bash", "-n")
|
|
check.Stdin = strings.NewReader(script)
|
|
if result, e := check.CombinedOutput(); e != nil {
|
|
t.Fatalf("invalid firewall script: %s %v", result, e)
|
|
}
|
|
}
|
|
var out, err bytes.Buffer
|
|
if code := nodeFirewall([]string{"--dry-run", "--peers", "10.0.0.0/8", "--controller-ip", "10.0.0.1"}, &out, &err); code != 2 {
|
|
t.Fatal("broad node range accepted")
|
|
}
|
|
}
|