fix: 隔离 Ayatori 数据库接入声明并修正 Instance 作用域

2026-09-27 17:56:33 +00:00
parent 7da5bc1181
commit 84a1e9e37f
16 changed files with 169 additions and 105 deletions
@@ -0,0 +1,51 @@
+"""校验渲染后的环境隔离与引用关系，无网络、集群写入或凭据访问。"""
+from pathlib import Path
+import re
+import subprocess
+import unittest
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[1] / 'ayatori'
+
+
+def render(environment):
+    return list(yaml.safe_load_all(subprocess.check_output(
+        ['kubectl', 'kustomize', str(ROOT / environment)], text=True)))
+
+
+class AyatoriManifestTests(unittest.TestCase):
+    def test_common_entry_cannot_register_instances_or_sync_credentials(self):
+        objects = render('.')
+        self.assertEqual([x['kind'] for x in objects], ['ConfigMap'])
+        self.assertEqual(objects[0]['metadata']['namespace'], 'ayatori-system')
+
+    def test_environment_isolation_scope_and_references(self):
+        for env, address, port in [('dev', '192.168.10.127', 5433), ('prod', '192.168.10.2', 5432)]:
+            with self.subTest(environment=env):
+                objects = render(env)
+                self.assertEqual(sorted(x['kind'] for x in objects),
+                                 ['ConfigMap', 'ExternalSecret', 'PostgreSQLInstance'])
+                instance = next(x for x in objects if x['kind'] == 'PostgreSQLInstance')
+                secret = next(x for x in objects if x['kind'] == 'ExternalSecret')
+                self.assertNotIn('namespace', instance['metadata'])
+                self.assertEqual(instance['metadata']['name'], 'homelab-' + env)
+                self.assertEqual(instance['spec']['endpoint'], {
+                    'host': 'pg-' + env + '.ad.ddupan.top', 'hostaddr': address,
+                    'port': port, 'database': 'postgres', 'sslMode': 'verify-full'})
+                self.assertEqual(secret['metadata']['namespace'], 'ayatori-system')
+                self.assertEqual(instance['spec']['adminCredentialRef']['name'], secret['spec']['target']['name'])
+                self.assertEqual(secret['spec']['secretStoreRef'],
+                                 {'name': 'homelab-postgresql-' + env + '-admin', 'kind': 'SecretStore'})
+                self.assertEqual({x['remoteRef']['key'] for x in secret['spec']['data']},
+                                 {'infra/postgresql/ayatori/' + env})
+                self.assertEqual({x['secretKey'] for x in secret['spec']['data']}, {'username', 'password'})
+                self.assertEqual({x['remoteRef']['property'] for x in secret['spec']['data']}, {'username', 'password'})
+                policy = (ROOT / env / 'eso-policy.hcl').read_text()
+                self.assertEqual(re.findall(r'path\s+"([^"]+)"', policy),
+                                 ['kv/data/infra/postgresql/ayatori/' + env])
+                self.assertEqual(re.findall(r'capabilities\s*=\s*\[([^]]+)\]', policy), ['"read"'])
+
+
+if __name__ == '__main__':
+    unittest.main()