SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix(device-plane): split edge channel bootstrap

Browse Source
This commit is contained in:
Codex
2026-08-11 23:27:16 +03:00
parent bb0724c52c
commit d641744dca
8 changed files with 1298 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/deploy-runner/build-device-manager-control-plane-artifact.mjs
+8 -16
View File
@@ -12,7 +12,7 @@ const devicePlaneRoot = resolve(platformRoot, "device-plane");
const designRoot = resolve(process.env.NODEDC_DEVICE_MANAGER_SOURCE_ROOT || resolve(platformRoot, "../NODEDC_DESIGN_GUIDELINE"));
const managerRoot = resolve(designRoot, "apps/device-manager");
const artifactDir = resolve(process.env.NODEDC_DEPLOY_ARTIFACT_DIR || resolve(scriptDir, "../deploy-artifacts"));
const [patchId = "device-manager-release-20260811-016", ...extra] = process.argv.slice(2);
const [patchId = "device-manager-release-20260811-018", ...extra] = process.argv.slice(2);
if (extra.length || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId)) throw new Error("usage: build-device-manager-control-plane-artifact.mjs [patch-id]");
const entries = [
@@ -27,7 +27,7 @@ const entries = [
"services/device-gateway/package.json",
"services/device-edge-relay/package.json",
"services/device-manager",
"deployment/device-manager-release-v2.json",
"deployment/device-manager-release-v1.json",
];
const stage = await mkdtemp(join(tmpdir(), "nodedc-device-manager-control-plane-"));
const payload = join(stage, "payload");
@@ -41,7 +41,7 @@ try {
if (build.status !== 0) throw new Error(`device_manager_build_failed:${build.stderr || build.stdout}`);
await mkdir(payload, { recursive: true });
for (const entry of entries) {
if (entry === "deployment/device-manager-release-v2.json") {
if (entry === "deployment/device-manager-release-v1.json") {
const descriptor = JSON.parse(await readFile(resolve(devicePlaneRoot, entry), "utf8"));
if (descriptor.releaseId !== "__PATCH_ID__") {
throw new Error("device_manager_release_template_id_mismatch");
@@ -100,20 +100,15 @@ try {
"DEVICE_MANAGEMENT_API_ENABLED: \"true\"",
"NODEDC_LAUNCHER_INTERNAL_TOKEN_FILE: /run/nodedc-secrets/device-core-internal-token",
"NODEDC_DEVICE_CORE_TOKEN_FILE: /run/nodedc-secrets/management-core-token",
"DEVICE_EDGE_CHANNEL_ENABLED: \"true\"",
"DEVICE_EDGE_CHANNEL_CORE_KEY_FILE: /run/nodedc-secrets/device-edge-channel/core-private-key.pem",
"DEVICE_EDGE_CHANNEL_CORE_CERTIFICATE_FILE: /run/nodedc-secrets/device-edge-channel/core-certificate.pem",
"DEVICE_EDGE_CHANNEL_TRUST_ROOT: /run/nodedc-secrets/device-edge-channel/peers",
"source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/core-private-key.pem",
"source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/core-certificate.pem",
"source: /volume1/docker/nodedc-device-plane/secrets/device-edge-channel/peers",
"name: nodedc-device-plane-egress",
"name: nodedc-platform_edge",
]) if (!compose.includes(required)) throw new Error(`device_manager_compose_contract_missing:${required}`);
for (const forbidden of [
"NODEDC_INTERNAL_ACCESS_TOKEN:",
"NODEDC_PLATFORM_SERVICE_TOKEN:",
"PRIVATE KEY",
"DEVICE_EDGE_CHANNEL_",
"device-edge-channel/",
"nodedc-device-plane-egress",
"0.0.0.0:18122",
"0.0.0.0:9921:9921",
"- \"9921:9921\"",
@@ -121,12 +116,12 @@ try {
if (compose.includes(forbidden)) throw new Error(`device_manager_compose_boundary_violation:${forbidden}`);
}
const descriptor = JSON.parse(await readFile(
join(payload, "deployment/device-manager-release-v2.json"),
join(payload, "deployment/device-manager-release-v1.json"),
"utf8",
));
const predecessor = descriptor.predecessor;
if (
descriptor.schemaVersion !== "nodedc.device-plane.device-manager-release.v2"
descriptor.schemaVersion !== "nodedc.device-plane.device-manager-release.v1"
|| descriptor.releaseId !== patchId
|| !["activate", "upgrade"].includes(descriptor.action)
|| !predecessor
@@ -134,9 +129,6 @@ try {
|| !/^[A-Za-z0-9._-]{1,96}$/.test(predecessor.patchId || "")
|| !/^[a-f0-9]{64}$/.test(predecessor.artifactSha256 || "")
|| (descriptor.action === "activate") !== (predecessor.kind === "reconciliation")
|| descriptor.edgeChannel !== "core-initiated-pinned-mtls-enabled-zero-or-more-registered-edges"
|| descriptor.edgeChannelIdentity !== "runner-managed-host-local-private-key-public-certificate-export"
|| descriptor.edgeChannelEgress !== "dedicated-core-only-bridge-no-host-ingress-public-ipv4-tcp-8443-registration-policy"
|| descriptor.healthGate !== "bounded-container-grace+core-contract"
|| descriptor.rollback !== "restore-preapply-snapshot"
) throw new Error("device_manager_activation_successor_contract_mismatch");