coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Align ESO token scripts with the periodic token (RPF-WP-0046)

Browse source 
renew-runtime-lease.sh is recovery-only now: it mints with -period
instead of -ttl=768h, so a recovery no longer undoes the platform's
periodic token, and defaults BAO_ADDR to the tunnel rather than the
retired bao.coulomb.social. The old openbao-eso-token-apply.sh is
retired for the same two reasons.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151986@bnt-lap001
Assistant-Session: ccd02b6b-80ae-48e5-8cad-9c8f74d21a67
This commit is contained in:
tegwick 2026-09-24 02:22:49 +02:00
parent 4a0e5aa53d
commit 21e8ce9b72
3 changed files with 51 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/renew-runtime-lease.sh
View file

@ -1,19 +1,27 @@
#!/usr/bin/env bash
# Contained remint of the ESO orphan token, then force-sync the runtime lease.
# RECOVERY ONLY: contained remint of the ESO token, then force-sync the runtime lease.
#
# Routine renewal is not this script's job. Since 2026-09-23 (railiance-platform
# RPF-WP-0046) external-secrets/openbao-audit-core-eso-token is a periodic 168h
# token renewed daily by the CronJob external-secrets/eso-token-renewer. Run
# this only when that token is lost or revoked and the platform has not
# re-minted it. It mints the same shape (-period, not -ttl), so a recovery
# does not undo the periodic lifecycle.
#
# Must be silent: `warden access --exec` fails closed on any child stdout/stderr
# even when the command succeeds. Persist metadata only. Never print a token.
#
# warden access openbao-platform-admin-login --exec -- \
# env RAILIANCE01_KUBECONFIG="$HOME/.kube/config-railiance01" \
# BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}" \
# BAO_ADDR=http://127.0.0.1:18200 \
# /home/worsch/audit-core/scripts/renew-runtime-lease.sh
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-/home/worsch/.kube/config-railiance01}"
export KUBECONFIG="$RAILIANCE01_KUBECONFIG"
export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
# bao.coulomb.social is retired (2026-09-15); the tunnel is the operator path.
export BAO_ADDR="${BAO_ADDR:-http://127.0.0.1:18200}"
# Contained login persists the session in $HOME/.vault-token and unsets
# BAO_TOKEN/VAULT_TOKEN. Do not prompt; do not re-export a token.
unset BAO_TOKEN VAULT_TOKEN OPENBAO_TOKEN || true
@ -21,7 +29,7 @@ unset BAO_TOKEN VAULT_TOKEN OPENBAO_TOKEN || true
SECRET_NAME="${OPENBAO_AUDIT_CORE_ESO_SECRET:-openbao-audit-core-eso-token}"
SECRET_NS="${OPENBAO_AUDIT_CORE_ESO_NAMESPACE:-external-secrets}"
POLICY="${OPENBAO_AUDIT_CORE_POLICIES:-external-secrets-audit-core}"
TTL="${OPENBAO_AUDIT_CORE_ESO_TTL:-768h}"
PERIOD="${OPENBAO_AUDIT_CORE_ESO_PERIOD:-168h}"
EVIDENCE="$ROOT/docs/evidence/$(date -u +%Y-%m-%d)-eso-token-remint.json"
WORKDIR="${HOME:-/tmp}/audit-core-remint"
mkdir -p "$WORKDIR"
@ -81,7 +89,7 @@ fi
token_json_file="$WORKDIR/token-create.json"
rm -f "$token_json_file"
if ! bao token create -policy="$POLICY" -ttl="$TTL" -renewable=true -orphan -format=json \
if ! bao token create -policy="$POLICY" -period="$PERIOD" -orphan -format=json \
>"$token_json_file" 2>/dev/null; then
_write_evidence failed '{"reason": "token_create_failed"}'
rm -f "$token_json_file"
@ -106,7 +114,7 @@ if [[ $create_status -ne 0 || ! -s "$child_file" ]]; then
rm -f "$child_file"
exit 1
fi
_write_evidence token_created '{"ttl": "768h", "orphan": true, "renewable": true}'
_write_evidence token_created "{\"period\": \"$PERIOD\", \"orphan\": true}"
kubectl -n "$SECRET_NS" delete secret "$SECRET_NAME" --ignore-not-found >/dev/null 2>&1 || true
if ! kubectl -n "$SECRET_NS" create secret generic "$SECRET_NAME" \