重构为直接 OpenSandbox 生命周期调度

2026-09-18 18:12:10 +00:00
parent 6a58c95c5c
commit f3a199e7ba
10 changed files with 556 additions and 465 deletions
@@ -0,0 +1,53 @@
+import json
+
+from gitea_dynamic_runner.opensandbox_identity import (
+    identity_entry,
+    is_runner_sandbox,
+    task_environment,
+)
+from gitea_dynamic_runner.sandbox_kubernetes import allocated_pod_name
+
+
+def batchsandbox():
+    return {
+        "metadata": {
+            "name": "sandbox-1",
+            "labels": {"ci.ddupan.top/runner": "true"},
+            "annotations": {
+                "sandbox.opensandbox.io/alloc-status": json.dumps(
+                    {"pods": ["ci-vm-pod-1"]}
+                )
+            },
+        },
+        "spec": {
+            "taskTemplate": {
+                "spec": {
+                    "process": {
+                        "env": [
+                            {
+                                "name": "CI_SPIFFE_ID",
+                                "value": "spiffe://ddupan.top/ci/org/repo/test",
+                            }
+                        ]
+                    }
+                }
+            }
+        },
+    }
+
+
+def test_extracts_allocation_and_identity_environment():
+    document = batchsandbox()
+    assert is_runner_sandbox(document)
+    assert allocated_pod_name(document) == "ci-vm-pod-1"
+    assert task_environment(document)["CI_SPIFFE_ID"].endswith("/org/repo/test")
+
+
+def test_entry_binds_exact_pod_agent_and_runner_uid():
+    entry = identity_entry(
+        sandbox_id="sandbox-1",
+        pod_uid="pod-uid",
+        spiffe_id="spiffe://ddupan.top/ci/org/repo/test",
+    )
+    assert entry["spec"]["parentID"].endswith("/sandbox-kata/pod/pod-uid")
+    assert entry["spec"]["selectors"] == ["unix:uid:2000"]