Prepare authenticated lifecycle runtime and production release candidate
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
parent
f3b71b1521
commit
4f546ae3b1
41 changed files with 2598 additions and 52 deletions
|
|
@ -24,8 +24,65 @@ def validate_policy(policy):
|
|||
raise ValueError('exact policy package/version/digest required')
|
||||
|
||||
|
||||
def validate_workload(value):
|
||||
if (not isinstance(value,dict) or set(value)!={'registries_configmap','peers','api_egress','intake','lifecycle'}
|
||||
or any(type(value[k]) is not bool for k in ('intake','lifecycle'))
|
||||
or not (value['intake'] or value['lifecycle'])
|
||||
or not re.fullmatch(r'[a-z0-9][a-z0-9.-]{0,62}',value['registries_configmap'])):
|
||||
raise ValueError('exact workload listener configuration required')
|
||||
for key in ('peers','api_egress'):
|
||||
if not isinstance(value[key],list) or not 1<=len(value[key])<=16:
|
||||
raise ValueError('bounded exact workload peers required')
|
||||
for item in value['peers']:
|
||||
if (not isinstance(item,dict) or set(item)!={'namespace','app'}
|
||||
or any(not re.fullmatch(r'[a-z0-9][a-z0-9.-]{0,62}',x) for x in item.values())):
|
||||
raise ValueError('exact workload namespace and pod label required')
|
||||
for item in value['api_egress']:
|
||||
if not isinstance(item,dict) or set(item)!={'ip','port'} or type(item['port']) is not int or item['port'] not in (443,6443):
|
||||
raise ValueError('exact Kubernetes API endpoint required')
|
||||
address=ipaddress.ip_address(item['ip'])
|
||||
if address.is_loopback or address.is_unspecified or address.is_multicast:
|
||||
raise ValueError('routable API address required')
|
||||
|
||||
|
||||
def add_workload_objects(objects,pod,value,obj,readonly,peer):
|
||||
container=pod['containers'][0]
|
||||
container['ports'].append({'name':'workload','containerPort':8081})
|
||||
container['volumeMounts'].extend([
|
||||
readonly('kubernetes-api','/var/run/secrets/informed-decision/kubernetes'),
|
||||
readonly('workload-registry','/workload-registry')])
|
||||
pod['volumes'].extend([
|
||||
{'name':'kubernetes-api','projected':{'defaultMode':0o440,'sources':[
|
||||
{'serviceAccountToken':{'path':'token','expirationSeconds':600}},
|
||||
{'configMap':{'name':'kube-root-ca.crt','items':[{'key':'ca.crt','path':'ca.crt'}]}}]}},
|
||||
{'name':'workload-registry','configMap':{'name':value['registries_configmap'],'defaultMode':0o444}}])
|
||||
if value['intake']:
|
||||
container['volumeMounts'].append(readonly('sitting-requester','/var/run/secrets/informed-decision/requester'))
|
||||
pod['volumes'].append({'name':'sitting-requester','secret':{
|
||||
'secretName':'informed-decision-sitting-requester','defaultMode':0o440,'optional':False,
|
||||
'items':[{'key':'client-secret','path':'client-secret'}]}})
|
||||
objects.append(obj('v1','Service',NAME+'-workload',spec={'type':'ClusterIP',
|
||||
'selector':{**LABEL,'app.kubernetes.io/component':'review'},
|
||||
'ports':[{'name':'workload','port':8081,'targetPort':'workload','protocol':'TCP'}]}))
|
||||
objects[5]['spec']['ingress'].append({'from':[peer(p['namespace'],p['app']) for p in value['peers']],
|
||||
'ports':[{'protocol':'TCP','port':8081}]})
|
||||
for endpoint in value['api_egress']:
|
||||
address=ipaddress.ip_address(endpoint['ip'])
|
||||
objects[5]['spec']['egress'].append({'to':[{'ipBlock':{'cidr':str(address)+'/'+str(address.max_prefixlen)}}],
|
||||
'ports':[{'protocol':'TCP','port':endpoint['port']}]})
|
||||
role=obj('rbac.authorization.k8s.io/v1','ClusterRole',NAME+'-tokenreview',rules=[
|
||||
{'apiGroups':['authentication.k8s.io'],'resources':['tokenreviews'],'verbs':['create']}])
|
||||
binding=obj('rbac.authorization.k8s.io/v1','ClusterRoleBinding',NAME+'-tokenreview',
|
||||
roleRef={'apiGroup':'rbac.authorization.k8s.io','kind':'ClusterRole','name':NAME+'-tokenreview'},
|
||||
subjects=[{'kind':'ServiceAccount','name':'review','namespace':NAME}])
|
||||
for item in (role,binding):
|
||||
item['metadata'].pop('namespace')
|
||||
item['metadata']['annotations']['informed-decision.coulomb.social/admission']='proposal; INFD-WP-0007/INFD-WP-0005 owner review required'
|
||||
objects.append(item)
|
||||
|
||||
|
||||
def render(inputs):
|
||||
if not isinstance(inputs,dict) or (set(inputs)-{'ordinary_approval_ids','lifecycle_policy','lifecycle_delivery'})!={'image','policy','keycape_egress_ips','storage_class'}:
|
||||
if not isinstance(inputs,dict) or (set(inputs)-{'ordinary_approval_ids','lifecycle_policy','lifecycle_delivery','workload_api','intake_attributes','intake_delivery'})!={'image','policy','keycape_egress_ips','storage_class'}:
|
||||
raise ValueError('exact image, policy, KeyCape egress IPs and storage class inputs required')
|
||||
if not re.fullmatch(r'forgejo\.coulomb\.social/coulomb/informed-decision@sha256:[0-9a-f]{64}',inputs['image']):
|
||||
raise ValueError('immutable Informed Decision registry digest required')
|
||||
|
|
@ -67,6 +124,32 @@ def render(inputs):
|
|||
raise ValueError('lifecycle delivery must be boolean')
|
||||
config['lifecycle_delivery']=inputs['lifecycle_delivery']
|
||||
|
||||
if 'intake_attributes' in inputs:
|
||||
if type(inputs['intake_attributes']) is not bool:
|
||||
raise ValueError('intake attributes must be boolean')
|
||||
config['intake_attributes']=inputs['intake_attributes']
|
||||
if 'intake_delivery' in inputs:
|
||||
if inputs['intake_delivery'] != {'hub_origin':'http://state-hub.state-hub.svc.cluster.local:8000'}:
|
||||
raise ValueError('exact State Hub delivery origin required')
|
||||
config['intake_delivery']=inputs['intake_delivery']
|
||||
if 'workload_api' in inputs:
|
||||
workload=inputs['workload_api']
|
||||
validate_workload(workload)
|
||||
if workload['lifecycle'] and (not lifecycle or inputs.get('lifecycle_delivery') is not True):
|
||||
raise ValueError('workload lifecycle needs policy and evidence delivery')
|
||||
if workload['intake'] and (inputs.get('intake_attributes') is not True or 'intake_delivery' not in inputs):
|
||||
raise ValueError('private intake needs attribute and delivery composition')
|
||||
config['workload_api']={'token_review':{'origin':'https://kubernetes.default.svc:443',
|
||||
'ca_file':'/var/run/secrets/informed-decision/kubernetes/ca.crt',
|
||||
'token_file':'/var/run/secrets/informed-decision/kubernetes/token'}}
|
||||
if workload['lifecycle']:
|
||||
config['workload_api']['lifecycle_callers_file']='/workload-registry/lifecycle-callers.json'
|
||||
if workload['intake']:
|
||||
config['workload_api']['intake']={
|
||||
'secret_file':'/var/run/secrets/informed-decision/requester/client-secret',
|
||||
'submitters_file':'/workload-registry/intake-submitters.json',
|
||||
'groups_file':'/workload-registry/review-groups.json'}
|
||||
|
||||
raw=json.dumps(config,sort_keys=True,separators=(',',':'))
|
||||
config_name=NAME+'-runtime-'+hashlib.sha256(raw.encode()).hexdigest()[:12]
|
||||
def obj(api,kind,name,**values):
|
||||
|
|
@ -124,6 +207,11 @@ def render(inputs):
|
|||
# its exact peer for CNI enforcement after Service DNAT.
|
||||
{'to':[peer('kube-system','traefik')],'ports':[{'protocol':'TCP','port':8443}]},
|
||||
{'to':[{'ipBlock':{'cidr':cidr}} for cidr in cidrs],'ports':[{'protocol':'TCP','port':443}]}]})]
|
||||
if 'intake_delivery' in inputs:
|
||||
objects[5]['spec']['egress'].append({'to':[peer('state-hub','state-hub')],
|
||||
'ports':[{'protocol':'TCP','port':8000}]})
|
||||
if 'workload_api' in inputs:
|
||||
add_workload_objects(objects, pod, inputs['workload_api'], obj, readonly, peer)
|
||||
# Counterparty proposals travel in the review packet. Neither the existing
|
||||
# Approval Engine namespace gate nor other Flex callers admits this pod.
|
||||
# Audit Core already owns its prepared exact informed-decision ingress.
|
||||
|
|
|
|||
|
|
@ -20,6 +20,7 @@ def main():
|
|||
parser=argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument('--image',required=True)
|
||||
parser.add_argument('--receipt',type=Path,required=True)
|
||||
parser.add_argument('--workload',action='store_true',help='exercise the separate private workload listener')
|
||||
args=parser.parse_args()
|
||||
prefix='infd-proof-'+uuid.uuid4().hex[:12]
|
||||
volumes=[];containers=[];checks=[]
|
||||
|
|
@ -89,6 +90,17 @@ assert s.submission(d.id)['state']=='unresolved'
|
|||
'package':'container.fixture','version':'v1','package_digest':'sha256:'+'a'*64,
|
||||
'caller_token_file':'/configuration/caller-token'},
|
||||
'audit':{'origin':'http://127.0.0.1:18084','sender_token_file':'/configuration/audit-token'}}
|
||||
if args.workload:
|
||||
config['lifecycle_policy']={**config['policy'],'package':'container.lifecycle.fixture'}
|
||||
config['lifecycle_delivery']=True
|
||||
config['workload_api']={'token_review':{'origin':'https://127.0.0.1:18443',
|
||||
'ca_file':'/configuration/absent-ca','token_file':'/configuration/caller-token'},
|
||||
'lifecycle_callers_file':'/configuration/lifecycle-callers.json',
|
||||
'intake':{'secret_file':'/configuration/absent-requester',
|
||||
'submitters_file':'/configuration/intake-submitters.json',
|
||||
'groups_file':'/configuration/review-groups.json'}}
|
||||
for name in ('lifecycle-callers.json','intake-submitters.json','review-groups.json'):
|
||||
(fixture/name).write_text('{}')
|
||||
(fixture/'runtime.json').write_text(json.dumps(config))
|
||||
for file in fixture.iterdir():file.chmod(0o444)
|
||||
data=volume('data');backup=volume('backup')
|
||||
|
|
@ -102,6 +114,10 @@ assert s.submission(d.id)['state']=='unresolved'
|
|||
checks.append('private config/database modes enforced; package installer absent')
|
||||
command(first,"import urllib.request,urllib.error\nfor path,status in [('/readyz',503),('/review?memo_id=missing',401)]:\n try: urllib.request.urlopen('http://127.0.0.1:8080'+path)\n except urllib.error.HTTPError as e: assert e.code==status\n else: raise AssertionError(path)")
|
||||
checks.append('configured review refuses anonymous access and reports audit-unready status')
|
||||
if args.workload:
|
||||
command(first,"import urllib.request,urllib.error\nfor port,path,status in [(8081,'/v1/decisions',401),(8081,'/v1/memos',405),(8081,'/review',404),(8080,'/v1/decisions',404)]:\n try: urllib.request.urlopen('http://127.0.0.1:'+str(port)+path)\n except urllib.error.HTTPError as e: assert e.code==status\n else: raise AssertionError(path)")
|
||||
checks.append('private listener refuses anonymous lifecycle access and exposes no browser routes')
|
||||
checks.append('public listener exposes no private workload route')
|
||||
command(first,"from informed_decision.container import single_writer\ntry:\n with single_writer('/data/private'): pass\nexcept ValueError: pass\nelse: raise AssertionError('second writer admitted')")
|
||||
checks.append('a second writer cannot acquire the active evidence volume')
|
||||
command(first,seed)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue