tegwick
fa278674c1
The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.
76 lines
3.1 KiB
Bash
76 lines
3.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
declaration="$root/tenancy.yaml"
|
|
main="$root/cmd/flex-auth/main.go"
|
|
|
|
axis_value() {
|
|
local block="$1" axis="$2"
|
|
awk -v block="$block" -v axis="$axis" '
|
|
$1 == block ":" { in_block=1; next }
|
|
in_block && $1 ~ /^(current|implemented|target):$/ { exit }
|
|
in_block && $1 == axis ":" { gsub(/[^0-9]/, "", $2); print $2; exit }
|
|
' "$declaration"
|
|
}
|
|
|
|
current_a="$(axis_value current A)"
|
|
implemented_a="$(axis_value implemented A)"
|
|
current_i="$(axis_value current I)"
|
|
implemented_i="$(axis_value implemented I)"
|
|
declared_a="${implemented_a:-$current_a}"
|
|
declared_i="${implemented_i:-$current_i}"
|
|
|
|
fail() {
|
|
echo "posture drift: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
caller_mode_from_manifest() {
|
|
awk '
|
|
$0 ~ /--caller-auth-mode/ { getline; gsub(/^[[:space:]-]+/, ""); print; exit }
|
|
' "$1"
|
|
}
|
|
|
|
caller_mode_from_values() {
|
|
awk '
|
|
$1 == "callerAuth:" { in_block=1; next }
|
|
in_block && /^[^[:space:]#]/ { exit }
|
|
in_block && $1 == "mode:" { print $2; exit }
|
|
' "$1"
|
|
}
|
|
|
|
if grep -q 'authenticator.Authorize' "$main"; then
|
|
[[ "${declared_a:-0}" -ge 2 ]] || fail "caller authentication exists but current/implemented A is below 2"
|
|
for manifest in deploy/flex-auth-user-engine.yaml deploy/flex-auth-tenant-engine.yaml; do
|
|
grep -q -- '--caller-auth-mode' "$root/$manifest" || fail "$manifest omits caller auth mode"
|
|
mode="$(caller_mode_from_manifest "$root/$manifest")"
|
|
[[ "$mode" == "warn" || "$mode" == "enforce" ]] || fail "$manifest caller-auth-mode is ${mode:-empty}, not warn or enforce"
|
|
grep -q -- '--caller-binding' "$root/$manifest" || fail "$manifest omits the exact system binding"
|
|
grep -q 'flex-auth-reviewer' "$root/$manifest" || fail "$manifest omits the reviewer token projection"
|
|
done
|
|
[[ -f "$root/deploy/caller-auth-rbac.yaml" ]] || fail "TokenReview RBAC manifest is absent"
|
|
grep -q 'tokenreviews' "$root/charts/flex-auth/templates/rbac.yaml" || fail "overlay TokenReview RBAC template is absent"
|
|
for values in values/user-engine.yaml values/tenant-engine.yaml; do
|
|
mode="$(caller_mode_from_values "$root/$values")"
|
|
[[ "$mode" == "warn" || "$mode" == "enforce" ]] || fail "$values callerAuth.mode is ${mode:-empty}, not warn or enforce"
|
|
grep -q 'binding:' "$root/$values" || fail "$values omits callerAuth.binding"
|
|
done
|
|
else
|
|
[[ "${declared_a:-0}" -lt 2 ]] || fail "A2 is declared without a caller-authentication choke point"
|
|
fi
|
|
|
|
if grep -R --include='*.go' --exclude='*_test.go' -q 'tenantengine\.' "$root"; then
|
|
[[ "${declared_i:-0}" -ge 3 ]] || fail "tenant-engine is called but I3 is not declared"
|
|
else
|
|
[[ "${declared_i:-0}" -lt 3 ]] || fail "I3 is declared without a non-test tenant-engine caller"
|
|
fi
|
|
|
|
if grep -qE '^ R: "?n/a"?' "$declaration"; then
|
|
for manifest in deploy/flex-auth-user-engine.yaml deploy/flex-auth-tenant-engine.yaml; do
|
|
! grep -q -- '--log' "$root/$manifest" || fail "$manifest persists a decision log while R is n/a"
|
|
! grep -q 'persistentVolumeClaim:' "$root/$manifest" || fail "$manifest mounts persistent storage while R is n/a"
|
|
done
|
|
fi
|
|
|
|
echo "posture declaration matches source and desired deployment controls"
|