SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(device-edge): add fail-closed ingress admission

Browse Source
This commit is contained in:
Codex
2026-08-04 11:53:18 +03:00
parent 3bb5e6dc27
commit 1eb6c462e3
11 changed files with 335 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/deploy-runner/build-device-edge-ingress-artifact.mjs
+15 -6
View File
@@ -23,7 +23,7 @@ const artifactDir = resolve(
|| resolve(scriptDir, "../deploy-artifacts"),
);
const [
patchId = "device-edge-ingress-ipvlan-20260804-001",
patchId = "device-edge-admission-gate-20260804-002",
...extra
] = process.argv.slice(2);
@@ -38,7 +38,7 @@ const files = [
"docker-compose.device-edge.ingress.yml",
"services/device-edge-relay/Dockerfile",
"services/device-edge-relay/src",
"deployment/device-edge-ingress-ipvlan-v1.json",
"deployment/device-edge-admission-gate-v1.json",
];
const ignoredBasenames = new Set([".DS_Store", ".git", "node_modules"]);
const descriptor = await assertBoundary();
@@ -84,7 +84,7 @@ try {
artifact: target,
sha256: digest,
component: "device-edge",
transition: "single-nic-ipvlan-b2-relay-only",
transition: "reviewed-ipvlan-b2-relay-admission-gate",
entries: files,
services: ["device-edge-relay"],
preservedRuntime: ["device-edge-backhaul", "tailnet", "Gelios"],
@@ -96,6 +96,9 @@ try {
ipv4Approval: descriptor.ingressIpv4Approval,
tcp: 9921,
hostPortPublication: "disabled",
sourceAdmission: descriptor.sourceAdmission,
maxTrackedSourceAddresses: descriptor.maxTrackedSourceAddresses,
maxBytesPerDirection: descriptor.maxBytesPerDirection,
lifecycle: "quarantine",
commandTransport: "disabled",
},
@@ -117,7 +120,7 @@ async function assertBoundary() {
const descriptor = JSON.parse(await readFile(
resolve(
sourceRoot,
"deployment/device-edge-ingress-ipvlan-v1.json",
"deployment/device-edge-admission-gate-v1.json",
),
"utf8",
));
@@ -145,6 +148,9 @@ async function assertBoundary() {
'DEVICE_EDGE_RELAY_INGRESS_ENABLED: "true"',
"DEVICE_EDGE_RELAY_UPSTREAM_HOST: device-edge-backhaul",
'DEVICE_EDGE_RELAY_UPSTREAM_PORT: "19921"',
"DEVICE_EDGE_RELAY_SOURCE_POLICY: public-ipv4-only",
'DEVICE_EDGE_RELAY_MAX_TRACKED_SOURCE_ADDRESSES: "2048"',
'DEVICE_EDGE_RELAY_MAX_BYTES_PER_DIRECTION: "262144"',
"name: nodedc-device-edge-ingress",
"driver: ipvlan",
"parent: enp1s0f0",
@@ -171,7 +177,7 @@ async function assertBoundary() {
}
const expected = {
schemaVersion: "nodedc.device-edge.ingress-ipvlan.v1",
schemaVersion: "nodedc.device-edge.admission-gate.v1",
mode: "single-nic-ipvlan-b2-relay-only",
runtimeHost: "ndcmini12",
component: "device-edge",
@@ -192,6 +198,9 @@ async function assertBoundary() {
hostPortPublication: "disabled",
healthPublication: "disabled",
privateUpstream: "device-edge-backhaul:19921",
sourceAdmission: "public-ipv4-only",
maxTrackedSourceAddresses: 2048,
maxBytesPerDirection: 262144,
protocolInspection: "gateway-owned",
identityTrust: "claimed-not-ownership-proof",
discoveryLifecycle: "quarantine",
@@ -199,7 +208,7 @@ async function assertBoundary() {
gelios: "untouched",
amneziaHostFullTunnel: "preserved",
routerNatFirewall: "separate-manual-gate",
rollback: "restore-predecessor-relay-remove-unused-ingress-network",
rollback: "restore-reviewed-ipvlan-predecessor-without-network-or-router-mutation",
};
if (JSON.stringify(descriptor) !== JSON.stringify(expected)) {
throw new Error("device_edge_ingress_descriptor_mismatch");