58 lines
4.1 KiB
PowerShell
58 lines
4.1 KiB
PowerShell
|
$ErrorActionPreference = 'Stop'
|
||
|
|
$PSNativeCommandUseErrorActionPreference = $true
|
||
|
|
$root = Split-Path -Parent $PSScriptRoot
|
||
|
|
Set-Location -LiteralPath $root
|
||
|
|
|
||
|
|
$temporaryRoot = Join-Path ([System.IO.Path]::GetTempPath()) ('infrastructure-conformance-' + [Guid]::NewGuid().ToString('N'))
|
||
|
|
$capturePath = Join-Path $temporaryRoot 'capture.json'
|
||
|
|
$reportPath = Join-Path $temporaryRoot 'report.json'
|
||
|
|
|
||
|
|
function Write-JsonUtf8([string]$path, $value) {
|
||
|
|
$json = $value | ConvertTo-Json -Depth 12
|
||
|
|
[System.IO.File]::WriteAllText($path, $json, [System.Text.UTF8Encoding]::new($false))
|
||
|
|
}
|
||
|
|
|
||
|
|
try {
|
||
|
|
New-Item -ItemType Directory -Path $temporaryRoot | Out-Null
|
||
|
|
$null = Invoke-RestMethod -Uri 'http://localhost:58080/health/ready'
|
||
|
|
$jwks = Invoke-RestMethod -Uri 'http://localhost:58180/realms/voice-local/protocol/openid-connect/certs'
|
||
|
|
if (@($jwks.keys).Count -lt 1) { throw '本地OIDC JWKS不可用' }
|
||
|
|
if ((docker compose exec -T postgres pg_isready -U voice -d voice_platform) -notmatch 'accepting connections') { throw '本地PostgreSQL不可用' }
|
||
|
|
if ((docker compose exec -T redis redis-cli ping).Trim() -ne 'PONG') { throw '本地Redis不可用' }
|
||
|
|
$null = Invoke-WebRequest -UseBasicParsing -Uri 'http://localhost:59000/minio/health/ready'
|
||
|
|
$null = Invoke-WebRequest -UseBasicParsing -Uri 'http://localhost:59190/-/ready'
|
||
|
|
foreach ($path in @('deploy/kubernetes/base/network-policies.yaml','deploy/prometheus/prometheus.yml','deploy/prometheus/rules/platform-alerts.yml')) {
|
||
|
|
if (-not (Test-Path -LiteralPath $path)) { throw "缺少本地配置引用：$path" }
|
||
|
|
}
|
||
|
|
|
||
|
|
$imageDigest = (docker image inspect data-terminal-cloud-api --format '{{.Id}}').Trim()
|
||
|
|
if ($imageDigest -notmatch '^sha256:[a-f0-9]{64}$') { throw '无法取得API镜像摘要' }
|
||
|
|
$observedAt = (Get-Date).ToUniversalTime().AddMinutes(-1)
|
||
|
|
$collectedAt = (Get-Date).ToUniversalTime()
|
||
|
|
$definitions = @(
|
||
|
|
@('DOMAIN_TLS','http://localhost:58080','LOCAL_HTTP_REACHABLE','probe:api-ready','compose.yaml'),
|
||
|
|
@('OIDC','http://localhost:58180/realms/voice-local','JWKS_AVAILABLE','probe:keycloak-jwks','deploy/keycloak/voice-local-realm.json'),
|
||
|
|
@('POSTGRES','compose:postgres','LOCAL_REACHABLE','probe:pg-isready','compose.yaml'),
|
||
|
|
@('REDIS','compose:redis','LOCAL_REACHABLE','probe:redis-ping','compose.yaml'),
|
||
|
|
@('OBJECT_STORE','compose:minio','LOCAL_REACHABLE','probe:minio-ready','compose.yaml'),
|
||
|
|
@('NETWORK_ISOLATION','kubernetes:network-policy','STATIC_RENDER_PRESENT','probe:file-present','deploy/kubernetes/base/network-policies.yaml'),
|
||
|
|
@('MONITORING','compose:prometheus','LOCAL_REACHABLE','probe:prometheus-ready','deploy/prometheus/prometheus.yml')
|
||
|
|
)
|
||
|
|
$components = @($definitions | ForEach-Object {
|
||
|
|
@{ component_type = $_[0]; resource_ref = $_[1]; status = 'VERIFIED'; observed_at = $observedAt.ToString('o'); verified_controls = @($_[2]); probe_ref = $_[3]; configuration_ref = $_[4]; audit_ref = 'local-smoke:no-external-audit' }
|
||
|
|
})
|
||
|
|
$capture = @{
|
||
|
|
schema_version = 'production-infrastructure-capture-v1'; evidence_source = 'LOCAL'; candidate_version = '0.63.0-rc.local'; build_digest = $imageDigest
|
||
|
|
environment = 'LOCAL'; region_ref = 'local-machine'; cluster_ref = 'docker-compose'; change_ticket_ref = 'local-smoke'
|
||
|
|
attested_by_ref = 'local-smoke-script'; attested_at = $observedAt.AddSeconds(30).ToString('o'); collected_at = $collectedAt.ToString('o'); components = $components
|
||
|
|
}
|
||
|
|
Write-JsonUtf8 $capturePath $capture
|
||
|
|
go run ./cmd/infrastructure-conformance -capture $capturePath -candidate-version '0.63.0-rc.local' -build-digest $imageDigest -output $reportPath
|
||
|
|
$report = Get-Content -Raw -LiteralPath $reportPath | ConvertFrom-Json
|
||
|
|
if ($report.result -ne 'PASS' -or $report.evidence_scope -ne 'LOCAL_INFRASTRUCTURE' -or -not $report.external_validation_required -or $report.component_count -ne 7) { throw '本地基础设施报告边界不正确' }
|
||
|
|
Write-Host '本地基础设施纵向冒烟通过：7类组件可达或配置存在；报告固定为LOCAL_INFRASTRUCTURE，生产门禁继续待验。'
|
||
|
|
} finally {
|
||
|
|
if (Test-Path -LiteralPath $temporaryRoot) { Remove-Item -LiteralPath $temporaryRoot -Recurse -Force }
|
||
|
|
Write-Host '已清理本地基础设施冒烟临时文件。'
|
||
|
|
}
|