feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

2026-09-25 19:34:48 +00:00
parent acd4b55722
commit 3a2fe5fa0c
92 changed files with 4211 additions and 0 deletions
@@ -0,0 +1,40 @@
+"""验证短期会话边界：失败不回退、子进程失败也撤销；不使用真实秘密。"""
+import importlib.util
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+
+spec = importlib.util.spec_from_file_location('pg_runner', Path(__file__).parents[1] / 'run.py')
+runner = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(runner)
+
+
+class RunnerTests(unittest.TestCase):
+    def test_revoke_on_child_failure(self):
+        with patch.object(runner.sys, 'argv', ['run.py', '--spiffe', 'ansible', 'credentials.yml']), \
+                patch.object(runner, 'spiffe_token', return_value='test-token'), \
+                patch.object(runner, 'run_command', side_effect=RuntimeError('child failed')), \
+                patch.object(runner, 'bao_request') as request:
+            with self.assertRaises(RuntimeError):
+                runner.main()
+            self.assertEqual(request.call_args.args[1:], ('auth/token/revoke-self', {}, 'test-token'))
+
+    def test_no_fallback_after_login_failure(self):
+        with patch.object(runner.sys, 'argv', ['run.py', '--spiffe', 'ansible', 'credentials.yml']), \
+                patch.object(runner, 'spiffe_token', side_effect=SystemExit('login failed')), \
+                patch.object(runner, 'run_command') as command:
+            with self.assertRaises(SystemExit):
+                runner.main()
+            command.assert_not_called()
+
+    def test_revoke_on_success_and_preserve_exit_code(self):
+        with patch.object(runner.sys, 'argv', ['run.py', '--spiffe', 'ansible', 'credentials.yml']), \
+                patch.object(runner, 'spiffe_token', return_value='test-token'), \
+                patch.object(runner, 'run_command', return_value=7), \
+                patch.object(runner, 'bao_request') as request:
+            self.assertEqual(runner.main(), 7)
+            request.assert_called_once()
+
+
+if __name__ == '__main__':
+    unittest.main()