Lemon-miaow
adf563ffe3
复用现有 k3s 调度和 Job 生命周期，增加 worker 接入与批准、受保护节点身份、归档传输、持久迁移锁及活动 PVC 切换；同步管理员 API、CLI、面板和隔离规则。分布式模式默认关闭，保持单机兼容。 验证：Go 全量测试与 vet；面板 874 个测试、lint/build；Linux VM 安装器测试、清单服务端 dry-run、网络命名空间防火墙实测。A/B/C 三机 WireGuard、Velocity 和迁移验收仍待完成。
62 lines
1.7 KiB
Go
62 lines
1.7 KiB
Go
package platform
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"felis.lolicon.best/internal/archivetransfer"
|
|
"felis.lolicon.best/internal/placement"
|
|
appsv1 "k8s.io/api/apps/v1"
|
|
rbacv1 "k8s.io/api/rbac/v1"
|
|
)
|
|
|
|
func TestDistributedControllerPinningAndArchivePowers(t *testing.T) {
|
|
p := testParams()
|
|
p.Distributed = true
|
|
p.ControllerNode = "a"
|
|
p.EgressProbe = "felis-api.felis.svc:443"
|
|
p.BackupPVC = "felis-backups"
|
|
p.ArchiveLocalPath = "/backups"
|
|
p.VelocityCIDRs = []string{"192.0.2.1/32"}
|
|
if err := p.Validate(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
found := false
|
|
for _, obj := range Objects(p) {
|
|
if d, ok := obj.(*appsv1.Deployment); ok {
|
|
if d.Spec.Template.Spec.NodeSelector[placement.LabelIdentity] != "a" {
|
|
t.Fatalf("controller workload %s may run on worker", d.Name)
|
|
}
|
|
if d.Name == ArchiveName {
|
|
found = true
|
|
s := d.Spec.Template.Spec
|
|
if s.AutomountServiceAccountToken == nil || *s.AutomountServiceAccountToken || s.ServiceAccountName != "" || len(s.Volumes) != 1 || s.Volumes[0].PersistentVolumeClaim.ClaimName != p.BackupPVC {
|
|
t.Fatal("archive has extra powers")
|
|
}
|
|
for _, c := range s.Containers {
|
|
for _, e := range c.Env {
|
|
if e.Name != archivetransfer.KeyEnv {
|
|
t.Fatal("archive received controller config")
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
if r, ok := obj.(*rbacv1.ClusterRole); ok {
|
|
for _, rule := range r.Rules {
|
|
for _, verb := range rule.Verbs {
|
|
if verb != "get" && verb != "list" {
|
|
t.Fatal("distributed cluster grant writes", r.Name, verb)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
if !found {
|
|
t.Fatal("archive service missing")
|
|
}
|
|
p.VelocityCIDRs = []string{"10.0.0.0/8"}
|
|
if p.Validate() == nil {
|
|
t.Fatal("broad Velocity source accepted")
|
|
}
|
|
}
|