From cb137f2044d0daedfa59d01ee1e2dbb53203cc17 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Sun, 20 Sep 2026 20:28:23 +0000 Subject: [PATCH] =?UTF-8?q?=E5=AE=8C=E6=88=90=20Nexus=20Ansible=20?= =?UTF-8?q?=E4=B8=8E=20Go=20=E7=BC=93=E5=AD=98=E9=AA=8C=E6=94=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- apps/nexus/README.md | 21 +++++++++++--- apps/nexus/terraform/security.tf | 50 ++++++++++++++++++++++++++++++++ apps/nexus/terraform/versions.tf | 23 +++++++++++++-- platform/spire/README.md | 6 ++++ 4 files changed, 93 insertions(+), 7 deletions(-) create mode 100644 apps/nexus/terraform/security.tf diff --git a/apps/nexus/README.md b/apps/nexus/README.md index 53575d5..f13d000 100644 --- a/apps/nexus/README.md +++ b/apps/nexus/README.md @@ -49,12 +49,13 @@ DNS 期望状态已加入 `infrastructure/dns/records.yml`，需从 Samba AD Ans 初始管理员密码生成在 PVC 的 `/nexus-data/admin.password`。只在交互式终端中读取并立即 完成首次密码轮换；不得把密码复制进 shell tracing、工单、Git 或命令参数。随后将 -Terraform 管理账号的凭据存入 OpenBao，由 CI 注入以下环境变量： +Terraform 管理账号的凭据存入 OpenBao，由 CI 通过 Terraform input variable 注入以下 +环境变量： ```text -NXRM_SERVER_URL=https://nexus.ad.ddupan.top -NXRM_SERVER_USERNAME= -NXRM_SERVER_PASSWORD= +TF_VAR_nexus_url=https://nexus.ad.ddupan.top +TF_VAR_nexus_username=admin +TF_VAR_nexus_password= ``` `terraform/` 使用 `sonatype-nexus-community/sonatyperepo` 1.17.0，当前声明： @@ -72,6 +73,18 @@ terraform -chdir=apps/nexus/terraform init -backend=false terraform -chdir=apps/nexus/terraform validate ``` +Terraform 同时把内置 `anonymous` 用户从默认的全仓库 `nx-anonymous` 角色收窄到 +`ansible-public`、其返回制品 URL 使用的 `ansible-galaxy-proxy`，以及 `go-public` 的 +`browse/read` 权限。首次接管已有实例时先执行 +`terraform import sonatyperepo_user.anonymous anonymous,default`，再 apply；不要先启用默认的 +全仓库匿名读取。 + +2026-09-20 的 POC 现场验收已确认：Flux 与 Pod Ready、PVC Bound、HTTPRoute 通过 HTTPS +返回 Nexus 状态 200，Samba DNS 已幂等收敛。全新客户端目录通过匿名入口下载 +`community.general:11.2.0` 时冷缓存为 8.49 秒、热缓存为 1.89 秒，两次 tarball SHA-256 +一致；`golang.org/x/text@v0.30.0` 为 2.92 秒与 1.51 秒。该结果只证明 Ansible/Go +代理链路，不代表 OCI、BuildKit cache、备份恢复或正式数据库已经验收。 + ## 客户端验收 先验证冷缓存，再原样重复命令验证热缓存；记录 Nexus 请求、上游流量和耗时，不只观察 diff --git a/apps/nexus/terraform/security.tf b/apps/nexus/terraform/security.tf new file mode 100644 index 0000000..0fe69bd --- /dev/null +++ b/apps/nexus/terraform/security.tf @@ -0,0 +1,50 @@ +resource "sonatyperepo_privilege_repository_view" "anonymous_ansible" { + name = "ci-anonymous-ansible-read" + description = "Anonymous read access to the Ansible Galaxy group" + actions = ["BROWSE", "READ"] + format = "ansiblegalaxy" + repository = sonatyperepo_repository_ansiblegalaxy_group.public.name +} + +resource "sonatyperepo_privilege_repository_view" "anonymous_ansible_proxy" { + name = "ci-anonymous-ansible-proxy-read" + description = "Anonymous artifact read access to the Ansible Galaxy proxy" + actions = ["BROWSE", "READ"] + format = "ansiblegalaxy" + repository = sonatyperepo_repository_ansiblegalaxy_proxy.galaxy.name +} + +resource "sonatyperepo_privilege_repository_view" "anonymous_go" { + name = "ci-anonymous-go-read" + description = "Anonymous read access to the Go module group" + actions = ["BROWSE", "READ"] + format = "go" + repository = sonatyperepo_repository_go_group.public.name +} + +resource "sonatyperepo_role" "anonymous_ci" { + id = "ci-anonymous-read" + name = "CI anonymous read" + description = "Read-only access to public CI dependency proxy groups" + privileges = [ + sonatyperepo_privilege_repository_view.anonymous_ansible.name, + sonatyperepo_privilege_repository_view.anonymous_ansible_proxy.name, + sonatyperepo_privilege_repository_view.anonymous_go.name, + ] + roles = [] +} + +resource "sonatyperepo_user" "anonymous" { + user_id = "anonymous" + first_name = "Anonymous" + last_name = "User" + email_address = "anonymous@example.org" + status = "active" + roles = [sonatyperepo_role.anonymous_ci.id] +} + +resource "sonatyperepo_system_anonymous_access" "ci" { + enabled = true + user_id = sonatyperepo_user.anonymous.user_id + realm_name = "NexusAuthorizingRealm" +} diff --git a/apps/nexus/terraform/versions.tf b/apps/nexus/terraform/versions.tf index 21d81a3..700940e 100644 --- a/apps/nexus/terraform/versions.tf +++ b/apps/nexus/terraform/versions.tf @@ -10,7 +10,24 @@ terraform { } provider "sonatyperepo" { - # NXRM_SERVER_URL, NXRM_SERVER_USERNAME and NXRM_SERVER_PASSWORD are injected - # from OpenBao by CI. - # Provider credentials must never be committed or placed in tfvars/state. + url = var.nexus_url + username = var.nexus_username + password = var.nexus_password +} + +variable "nexus_url" { + description = "Nexus Repository base URL" + type = string +} + +variable "nexus_username" { + description = "Nexus Terraform management username" + type = string + sensitive = true +} + +variable "nexus_password" { + description = "Nexus Terraform management password" + type = string + sensitive = true } diff --git a/platform/spire/README.md b/platform/spire/README.md index ec07cab..40413f6 100644 --- a/platform/spire/README.md +++ b/platform/spire/README.md @@ -74,6 +74,12 @@ Agent 已启用 Unix workload attestor，并为本机用户 `panxiao81`（UID `1 export SPIFFE_ENDPOINT_SOCKET=unix:///run/spire/agent-sockets/spire-agent.sock ``` +宿主机已安装与 Agent Pod 同版本的 `/usr/local/bin/spire-agent` 1.15.3，供本地进程从 +Workload API 获取 JWT-SVID。二进制来自 SPIRE 官方 `linux-amd64-musl` release，安装时 +核对 tarball SHA-256 +`ca1a4d1155317bdd2afc7f36663828a10410c7c840e54725b90b4064b0a301c7`。升级 chart 时应 +同步升级这个 CLI 并重新核对官方 checksum，不能长期混用版本。 + 该身份仅按 Unix UID 匹配，不是 SPIRE admin，也不会匹配 `sudo` 后以 root 运行的 进程。`ClusterStaticEntry.spec.parentID` 绑定当前 `laptop` Kubernetes node UID；若 节点被删除后重建，需从 `spire-server agent list` 取得新 Agent ID 并同步更新该字段。