coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

access-engine: secret-read evaluator for warden fetch checks (CUST-WP-0075)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m12s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
This commit is contained in:
tegwick 2026-10-03 08:57:11 +02:00
parent 1309c093bb
commit 02b15a7f72
16 changed files with 1542 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tests/stage1.sh
View file

@ -33,6 +33,26 @@ echo "$ops_render" | grep -q 'ops-warden=system:serviceaccount:ops-warden:ops-wa
echo "$ops_render" | grep -q production_registry_snapshot.json \
|| { echo "ops-warden render omits the production registry" >&2; exit 1; }
# The fetch pin's digest stays empty until CI builds an image containing
# examples/ops-warden-fetch; render it with a placeholder until then.
fetch_digest_args=()
if grep -Eq '^\s*digest:\s*(""|)\s*$' values/ops-warden-fetch.yaml; then
echo "note: values/ops-warden-fetch.yaml has no image digest yet (not deployable); rendering with a placeholder"
fetch_digest_args=(--set image.digest=sha256:0000000000000000000000000000000000000000000000000000000000000000)
fi
echo "helm template values/ops-warden-fetch.yaml"
fetch_render="$(helm template flex-auth-ops-warden-fetch charts/flex-auth -f values/ops-warden-fetch.yaml "${fetch_digest_args[@]}" --namespace flex-auth)"
echo "$fetch_render" | grep -A1 -- '--caller-auth-mode' | grep -q enforce \
|| { echo "ops-warden-fetch caller-auth-mode must be enforce" >&2; exit 1; }
for system in railiance-platform key-cape; do
echo "$fetch_render" | grep -q "${system}=system:serviceaccount:ops-warden:ops-warden" \
|| { echo "ops-warden-fetch render omits the ${system} binding" >&2; exit 1; }
done
echo "$fetch_render" | grep -q examples/ops-warden-fetch/policy_package.md \
|| { echo "ops-warden-fetch render omits its policy package" >&2; exit 1; }
python3 tools/gen_ops_warden_fetch.py --check >/dev/null 2>&1 || [ ! -f "${HOME}/ops-warden/registry/routing/catalog.yaml" ] \
|| { echo "ops-warden-fetch is out of date with the routing catalog; run tools/gen_ops_warden_fetch.py" >&2; exit 1; }
canary_render="$(helm template flex-auth-canary charts/flex-auth -f values/stage2-canary.yaml --namespace flex-auth)"
if echo "$canary_render" | grep -q tokenreviews; then
echo "isolated canary must not create TokenReview RBAC" >&2