Lemon-miaow
adf563ffe3
复用现有 k3s 调度和 Job 生命周期，增加 worker 接入与批准、受保护节点身份、归档传输、持久迁移锁及活动 PVC 切换；同步管理员 API、CLI、面板和隔离规则。分布式模式默认关闭，保持单机兼容。 验证：Go 全量测试与 vet；面板 874 个测试、lint/build；Linux VM 安装器测试、清单服务端 dry-run、网络命名空间防火墙实测。A/B/C 三机 WireGuard、Velocity 和迁移验收仍待完成。
57 lines
1.3 KiB
Go
57 lines
1.3 KiB
Go
package main
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"io"
|
|
"net"
|
|
"time"
|
|
)
|
|
|
|
// A trusted probe runs with the same server labels and security context before node admission.
|
|
func cmdNodeProbe(args []string, stdout, stderr io.Writer) int {
|
|
fs := flag.NewFlagSet("node-probe", flag.ContinueOnError)
|
|
fs.SetOutput(stderr)
|
|
listen := fs.String("listen", "", "listen and print observed source addresses (admission only)")
|
|
var open, closed multiFlag
|
|
fs.Var(&open, "open", "required reachable host:port")
|
|
fs.Var(&closed, "closed", "required blocked host:port")
|
|
if err := fs.Parse(args); err != nil {
|
|
return 2
|
|
}
|
|
if *listen != "" {
|
|
l, err := net.Listen("tcp", *listen)
|
|
if err != nil {
|
|
fmt.Fprintln(stderr, err)
|
|
return 1
|
|
}
|
|
defer l.Close()
|
|
for {
|
|
c, err := l.Accept()
|
|
if err != nil {
|
|
return 1
|
|
}
|
|
fmt.Fprintln(stdout, "felis-probe-source", c.RemoteAddr().String())
|
|
c.Write([]byte("felis-probe\n"))
|
|
c.Close()
|
|
}
|
|
}
|
|
time.Sleep(3 * time.Second)
|
|
for _, check := range []struct {
|
|
addresses []string
|
|
wantOpen bool
|
|
}{{open, true}, {closed, false}} {
|
|
for _, addr := range check.addresses {
|
|
c, err := net.DialTimeout("tcp", addr, 2*time.Second)
|
|
if c != nil {
|
|
c.Close()
|
|
}
|
|
if (err == nil) != check.wantOpen {
|
|
fmt.Fprintf(stderr, "node-probe: %s open=%t, expected %t\n", addr, err == nil, check.wantOpen)
|
|
return 1
|
|
}
|
|
}
|
|
}
|
|
return 0
|
|
}
|