bluejay/bluejay-infra
1
0
Fork 0
Code Issues Pull Requests 15 Actions Packages Projects Releases Wiki Activity

deploy(gx10): add NanoHUB Apple MDM workload

Browse Source
This commit is contained in:
Robot
2026-06-17 22:45:10 -05:00
parent c32327cdee
commit 83db2bbe6b
4 changed files with 510 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

179
tests/bluejay-infra-lint/Gx10AppleMdmNanohubTests.cs Normal file
View File

@@ -0,0 +1,179 @@
using FluentAssertions;
using Xunit;
using YamlDotNet.RepresentationModel;
namespace BluejayInfraLint.Tests;
[Trait("Category", "Unit")]
public sealed class Gx10AppleMdmNanohubTests
{
private static readonly string Root = FindRepoRoot();
private static readonly string AppRoot = Path.Combine(Root, "apps-gx10", "fc-apple-mdm");
private static readonly IReadOnlyList<YamlMappingNode> Documents = LoadDocuments();
[Fact]
public void Manifest_DeclaresLockedDownNanoHubRuntime()
{
Documents.Should().Contain(document => Is(document, "Namespace", "fc-apple-mdm"));
Documents.Should().Contain(document => Is(document, "ConfigMap", "fc-apple-mdm-root-ca"));
Documents.Should().Contain(document => Is(document, "Service", "fc-apple-mdm"));
Documents.Should().Contain(document => Is(document, "NetworkPolicy", "fc-apple-mdm-netpol"));
Documents.Should().NotContain(document => (document.Scalar("kind") ?? string.Empty) == "Secret");
Documents.Should().NotContain(document => (document.Scalar("kind") ?? string.Empty) == "OnePasswordItem");
var pvc = Single("PersistentVolumeClaim", "fc-apple-mdm-data");
pvc.Scalar("spec", "storageClassName").Should().Be("local-path");
pvc.Scalar("spec", "resources", "requests", "storage").Should().Be("2Gi");
var deployment = Single("Deployment", "fc-apple-mdm");
deployment.Scalar("spec", "strategy", "type").Should().Be("Recreate");
deployment.Scalar("spec", "template", "metadata", "annotations", "fc.flowercore.io/probe-path").Should().Be("/version");
deployment.Scalar("spec", "template", "metadata", "annotations", "flowercore.io/root-ca-sha256")
.Should()
.Be("a9120c88fa3ec735d790aa4cfeb61ac2946730338969015bebaccc08fe10535e");
var maybePodSpec = deployment.Mapping("spec", "template", "spec");
maybePodSpec.Should().NotBeNull();
var podSpec = maybePodSpec!;
podSpec.Scalar("enableServiceLinks").Should().Be("false");
podSpec.Scalar("securityContext", "runAsUser").Should().Be("1654");
podSpec.Scalar("securityContext", "runAsNonRoot").Should().Be("true");
var container = podSpec.MappingSequence("containers").Should().ContainSingle().Subject;
container.Scalar("name").Should().Be("nanohub");
container.Scalar("image").Should().Be("localhost/fc-apple-mdm-nanohub:v0.2.0-20260617");
container.Scalar("imagePullPolicy").Should().Be("Never");
container.Scalar("securityContext", "readOnlyRootFilesystem").Should().Be("true");
container.Scalar("securityContext", "allowPrivilegeEscalation").Should().Be("false");
EnvValue(container, "NANOHUB_LISTEN").Should().Be(":9004");
EnvValue(container, "NANOHUB_STORAGE").Should().Be("file");
EnvValue(container, "NANOHUB_STORAGE_DSN").Should().Be("/var/lib/nanohub/db");
EnvValue(container, "NANOHUB_CHECKIN").Should().Be("true");
EnvValue(container, "NANOHUB_CA").Should().Be("/etc/nanohub/ca/root_ca.crt");
EnvSecretName(container, "NANOHUB_API_KEY").Should().Be("fc-apple-mdm-runtime");
EnvSecretKey(container, "NANOHUB_API_KEY").Should().Be("NANOHUB_API_KEY");
EnvSecretName(container, "NANOHUB_WEBHOOK_URL").Should().Be("fc-apple-mdm-runtime");
EnvSecretKey(container, "NANOHUB_WEBHOOK_URL").Should().Be("NANOHUB_WEBHOOK_URL");
EnvSecretOptional(container, "NANOHUB_WEBHOOK_URL").Should().Be("true");
VolumeMount(container, "data").Scalar("mountPath").Should().Be("/var/lib/nanohub");
VolumeMount(container, "root-ca").Scalar("mountPath").Should().Be("/etc/nanohub/ca");
VolumeMount(container, "root-ca").Scalar("readOnly").Should().Be("true");
ProbePath(container, "startupProbe").Should().Be("/version");
ProbePath(container, "readinessProbe").Should().Be("/version");
container.Scalar("livenessProbe", "tcpSocket", "port").Should().Be("9004");
}
[Fact]
public void Manifest_ExposesOnlyMdmCheckinAndVersionPaths()
{
var certificate = Single("Certificate", "fc-apple-mdm-tls");
certificate.Scalar("spec", "issuerRef", "name").Should().Be("step-ca-acme");
certificate.Scalar("spec", "issuerRef", "kind").Should().Be("ClusterIssuer");
certificate.ScalarSequence("spec", "dnsNames").Should().ContainSingle("mdm.iamworkin.lan");
var ingress = Single("IngressRoute", "fc-apple-mdm");
var route = ingress.MappingSequence("spec", "routes").Should().ContainSingle().Subject;
var match = route.Scalar("match");
match.Should().Contain("Host(`mdm.iamworkin.lan`)");
match.Should().Contain("PathPrefix(`/mdm`)");
match.Should().Contain("PathPrefix(`/checkin`)");
match.Should().Contain("PathPrefix(`/version`)");
match.Should().NotContain("/api/v1");
match.Should().NotContain("PathPrefix(`/api`)");
}
[Fact]
public void Readme_DocumentsSecretImportAndSupportBoundary()
{
var readme = File.ReadAllText(Path.Combine(AppRoot, "README.md"));
readme.Should().Contain("FlowerCore Apple MDM Runtime");
readme.Should().Contain("Secret/fc-apple-mdm-runtime");
readme.Should().Contain("imagePullPolicy: Never");
readme.Should().Contain("10.0.57.202");
readme.Should().Contain("does not create an APNs MDM push certificate");
readme.Should().Contain("managed Wi-Fi payload");
}
private static YamlMappingNode Single(string kind, string name)
{
return Documents.Single(document => Is(document, kind, name));
}
private static bool Is(YamlMappingNode document, string kind, string name)
{
return document.Scalar("kind") == kind
&& document.Scalar("metadata", "name") == name;
}
private static string? EnvValue(YamlMappingNode container, string name)
{
return EnvMapping(container, name)?.Scalar("value");
}
private static string? EnvSecretName(YamlMappingNode container, string name)
{
return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "name");
}
private static string? EnvSecretKey(YamlMappingNode container, string name)
{
return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "key");
}
private static string? EnvSecretOptional(YamlMappingNode container, string name)
{
return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "optional");
}
private static string? ProbePath(YamlMappingNode container, string probeKey)
{
return container.Scalar(probeKey, "httpGet", "path");
}
private static YamlMappingNode VolumeMount(YamlMappingNode container, string name)
{
return container.MappingSequence("volumeMounts")
.Single(mount => mount.Scalar("name") == name);
}
private static YamlMappingNode? EnvMapping(YamlMappingNode container, string name)
{
return container.MappingSequence("env")
.SingleOrDefault(env => env.Scalar("name") == name);
}
private static IReadOnlyList<YamlMappingNode> LoadDocuments()
{
var stream = new YamlStream();
using var reader = File.OpenText(Path.Combine(AppRoot, "fc-apple-mdm.yaml"));
stream.Load(reader);
return stream.Documents
.Select(document => document.RootNode)
.OfType<YamlMappingNode>()
.Where(mapping => !string.IsNullOrWhiteSpace(mapping.Scalar("kind")))
.ToList();
}
private static string FindRepoRoot()
{
var current = new DirectoryInfo(AppContext.BaseDirectory);
while (current is not null)
{
if (Directory.Exists(Path.Combine(current.FullName, "apps-gx10"))
&& Directory.Exists(Path.Combine(current.FullName, "tests"))
&& File.Exists(Path.Combine(current.FullName, "README.md")))
{
return current.FullName;
}
current = current.Parent;
}
throw new DirectoryNotFoundException("Could not find bluejay-infra root.");
}
}