源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

evals/fixtures/kube/kind-config-egress.yaml

@@ -0,0 +1,5 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+networking:
+  disableDefaultCNI: true
+  podSubnet: "192.168.0.0/16"

evals/fixtures/kube/mysql.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: openwork-mysql
+  labels:
+    app.kubernetes.io/name: openwork-mysql
+type: Opaque
+stringData:
+  MYSQL_ROOT_PASSWORD: password
+  MYSQL_DATABASE: openwork_den
+  MYSQL_USER: openwork
+  MYSQL_PASSWORD: openwork
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: openwork-mysql
+  labels:
+    app.kubernetes.io/name: openwork-mysql
+spec:
+  ports:
+    - name: mysql
+      port: 3306
+      targetPort: mysql
+  selector:
+    app.kubernetes.io/name: openwork-mysql
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: openwork-mysql
+  labels:
+    app.kubernetes.io/name: openwork-mysql
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: openwork-mysql
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: openwork-mysql
+    spec:
+      containers:
+        - name: mysql
+          image: mysql:8.4
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: mysql
+              containerPort: 3306
+          envFrom:
+            - secretRef:
+                name: openwork-mysql
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/mysql
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -lc
+                - mysqladmin ping -h 127.0.0.1 -uopenwork -p"$MYSQL_PASSWORD"
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 24
+      volumes:
+        - name: data
+          emptyDir: {}

evals/fixtures/kube/netpol/allow-core.yaml

@@ -0,0 +1,48 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openwork-den-allow-core-egress
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: openwork-ee
+      app.kubernetes.io/instance: openwork-ee
+    matchExpressions:
+      - key: app.kubernetes.io/component
+        operator: In
+        values:
+          - den-api
+          - den-web
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: openwork-mysql
+      ports:
+        - protocol: TCP
+          port: 3306
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: openwork-ee
+              app.kubernetes.io/instance: openwork-ee
+            matchExpressions:
+              - key: app.kubernetes.io/component
+                operator: In
+                values:
+                  - den-api
+                  - den-web

evals/fixtures/kube/netpol/allow-external.template.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openwork-den-allow-eval-mock-egress
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: openwork-ee
+      app.kubernetes.io/instance: openwork-ee
+    matchExpressions:
+      - key: app.kubernetes.io/component
+        operator: In
+        values:
+          - den-api
+          - den-web
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: ${OPENWORK_EVAL_KUBE_ALLOWED_HOST_IP}/32
+      ports:
+        - protocol: TCP
+          port: ${OPENWORK_EVAL_KUBE_ALLOWED_MOCK_PORT}

evals/fixtures/kube/netpol/default-deny-egress.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openwork-den-default-deny-egress
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: openwork-ee
+      app.kubernetes.io/instance: openwork-ee
+    matchExpressions:
+      - key: app.kubernetes.io/component
+        operator: In
+        values:
+          - den-api
+          - den-web
+  policyTypes:
+    - Egress
+  egress: []

evals/fixtures/kube/values/multi-org.yaml

@@ -0,0 +1,35 @@
+config:
+  openworkDevMode: "0"
+  denApiNodeOptions: --use-openssl-ca
+  tenancy:
+    mode: multi_org
+    allowPublicSignup: "true"
+    requireEmailVerification: "false"
+  public:
+    webOrigin: http://127.0.0.1:3005
+    apiOrigin: http://127.0.0.1:8790
+    mcpResourceUrl: http://127.0.0.1:8790/mcp
+    desktopDenBaseUrl: http://localhost:8790
+    corsOrigins: http://127.0.0.1:3005,http://localhost:3005,http://127.0.0.1:8790,http://localhost:8790,http://127.0.0.1:5173,http://localhost:5173
+    betterAuthTrustedOrigins: http://127.0.0.1:3005,http://localhost:3005,http://127.0.0.1:8790,http://localhost:8790,http://127.0.0.1:5173,http://localhost:5173
+    webAppHosts: 127.0.0.1,localhost
+    authCallbackUrl: http://127.0.0.1:3005
+  provisioner:
+    mode: stub
+secret:
+  values:
+    databaseUrl: mysql://openwork:openwork@openwork-mysql:3306/openwork_den
+    betterAuthSecret: local-dev-secret-not-for-production-use!!
+    denDbEncryptionKey: local-dev-db-encryption-key-please-change-1234567890
+denApi:
+  probes:
+    liveness:
+      initialDelaySeconds: 10
+    readiness:
+      initialDelaySeconds: 5
+denWeb:
+  probes:
+    liveness:
+      initialDelaySeconds: 20
+    readiness:
+      initialDelaySeconds: 5

evals/fixtures/kube/values/single-org.yaml

@@ -0,0 +1,37 @@
+config:
+  openworkDevMode: "0"
+  denApiNodeOptions: --use-openssl-ca
+  tenancy:
+    mode: single_org
+    singleOrgName: Acme Robotics
+    singleOrgSlug: default
+    allowPublicSignup: "true"
+    requireEmailVerification: "false"
+  public:
+    webOrigin: http://127.0.0.1:3005
+    apiOrigin: http://127.0.0.1:8790
+    mcpResourceUrl: http://127.0.0.1:8790/mcp
+    desktopDenBaseUrl: http://localhost:8790
+    corsOrigins: http://127.0.0.1:3005,http://localhost:3005,http://127.0.0.1:8790,http://localhost:8790,http://127.0.0.1:5173,http://localhost:5173
+    betterAuthTrustedOrigins: http://127.0.0.1:3005,http://localhost:3005,http://127.0.0.1:8790,http://localhost:8790,http://127.0.0.1:5173,http://localhost:5173
+    webAppHosts: 127.0.0.1,localhost
+    authCallbackUrl: http://127.0.0.1:3005
+  provisioner:
+    mode: stub
+secret:
+  values:
+    databaseUrl: mysql://openwork:openwork@openwork-mysql:3306/openwork_den
+    betterAuthSecret: local-dev-secret-not-for-production-use!!
+    denDbEncryptionKey: local-dev-db-encryption-key-please-change-1234567890
+denApi:
+  probes:
+    liveness:
+      initialDelaySeconds: 10
+    readiness:
+      initialDelaySeconds: 5
+denWeb:
+  probes:
+    liveness:
+      initialDelaySeconds: 20
+    readiness:
+      initialDelaySeconds: 5