95 lines
4.3 KiB
Python
95 lines
4.3 KiB
Python
|
"""Private lab transport regression fixtures; never contacts a real cluster."""
|
||
|
|
import json
|
||
|
|
import os
|
||
|
|
from pathlib import Path
|
||
|
|
import subprocess
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
|
||
|
|
ROOT = Path(__file__).resolve().parents[1]
|
||
|
|
SCRIPT = ROOT / 'sso-mfa/bootstrap/openbao-init-unseal.sh'
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.fixture
|
||
|
|
def lab(tmp_path):
|
||
|
|
metadata = tmp_path / 'metadata.json'
|
||
|
|
metadata.write_text(json.dumps({'deployment_profile': 'lab', 'openbao_unseal_custody_model': 'sops-held-automation'}))
|
||
|
|
source = tmp_path / 'secrets'; source.mkdir(mode=0o700)
|
||
|
|
executable = tmp_path / 'kubectl'
|
||
|
|
executable.write_text('''#!/usr/bin/python3
|
||
|
|
import json,os,pathlib,sys
|
||
|
|
root=pathlib.Path(os.environ['KUBECONFIG']).parent
|
||
|
|
state=root/'fixture-state.json'
|
||
|
|
x=json.loads(state.read_text()) if state.exists() else {'initialized':False,'sealed':True,'applied':0}
|
||
|
|
args=sys.argv[1:]
|
||
|
|
with (root/'calls.jsonl').open('a') as log: log.write(json.dumps(args)+'\\n')
|
||
|
|
assert not any(k in os.environ for k in ['VAULT_TOKEN','BAO_TOKEN','BASH_ENV'])
|
||
|
|
if args[:3]==['get','namespace','kube-system']:
|
||
|
|
print(json.dumps({'metadata':{'uid':'fixture-cluster'}}))
|
||
|
|
elif 'get' in args:
|
||
|
|
print(json.dumps({'metadata':{'uid':'fixture-pod','name':'openbao-0','namespace':'openbao'}}))
|
||
|
|
elif 'status' in args:
|
||
|
|
print(json.dumps(x));sys.exit(2 if x['sealed'] else 0)
|
||
|
|
elif 'init' in args:
|
||
|
|
x['initialized']=True;state.write_text(json.dumps(x))
|
||
|
|
print(json.dumps({'unseal_keys_b64':['A'*32,'B'*32,'C'*32], 'root_token':'fixture-private-root-marker'}))
|
||
|
|
elif 'sys/unseal' in args:
|
||
|
|
assert sys.stdin.read().strip() in ['A'*32,'B'*32,'C'*32]
|
||
|
|
x['applied']+=1;x['sealed']=x['applied']<2;state.write_text(json.dumps(x))
|
||
|
|
print('fixture-private-provider-response')
|
||
|
|
else: sys.exit(1)
|
||
|
|
print('fixture-private-provider-diagnostic',file=sys.stderr)
|
||
|
|
''')
|
||
|
|
executable.chmod(0o755)
|
||
|
|
env = {'PATH': str(tmp_path) + ':' + os.environ['PATH'], 'HOME': str(tmp_path),
|
||
|
|
'KUBECONFIG': str(tmp_path / 'fixture-kubeconfig'),
|
||
|
|
'OPENBAO_CONSOLE_METADATA': str(metadata), 'OPENBAO_EXPECTED_CLUSTER_UID': 'fixture-cluster',
|
||
|
|
'VAULT_TOKEN': 'fixture-ambient-token', 'BAO_TOKEN': 'fixture-ambient-token'}
|
||
|
|
return source, env, tmp_path
|
||
|
|
|
||
|
|
|
||
|
|
def invoke(lab):
|
||
|
|
source, env, _ = lab
|
||
|
|
return subprocess.run(['bash', '-x', str(SCRIPT), str(source)], env=env, capture_output=True, timeout=10)
|
||
|
|
|
||
|
|
|
||
|
|
def test_lab_init_unseal_keeps_material_private_and_never_uses_secret_argv(lab):
|
||
|
|
source, _, root = lab
|
||
|
|
r = invoke(lab)
|
||
|
|
assert r.returncode == 0
|
||
|
|
transcript = r.stdout + r.stderr
|
||
|
|
assert not any(x in transcript for x in [b'fixture-private-root-marker', b'fixture-private-provider-response',
|
||
|
|
b'fixture-private-provider-diagnostic', b'A'*32, b'B'*32])
|
||
|
|
material = source / 'openbao/init.json'
|
||
|
|
assert material.stat().st_mode & 0o077 == 0
|
||
|
|
calls = (root / 'calls.jsonl').read_bytes()
|
||
|
|
assert b'fixture-private-root-marker' not in calls
|
||
|
|
assert b'A'*32 not in calls and b'B'*32 not in calls
|
||
|
|
assert json.loads((root / 'fixture-state.json').read_text())['applied'] == 2
|
||
|
|
|
||
|
|
|
||
|
|
def test_prior_init_material_refuses_new_init_without_overwrite(lab):
|
||
|
|
source, _, root = lab
|
||
|
|
directory = source / 'openbao'; directory.mkdir(mode=0o700)
|
||
|
|
file = directory / 'init.json'; file.write_bytes(b'fixture-existing-custody'); file.chmod(0o600)
|
||
|
|
r = invoke(lab)
|
||
|
|
assert r.returncode != 0
|
||
|
|
assert file.read_bytes() == b'fixture-existing-custody'
|
||
|
|
assert not (root / 'fixture-state.json').exists()
|
||
|
|
assert b'"init"' not in (root / 'calls.jsonl').read_bytes()
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.parametrize('mutation', ['wrong-cluster', 'missing-profile', 'production', 'configure-initial'])
|
||
|
|
def test_lab_rejects_unadmitted_targets_and_automatic_root_followthrough(lab, mutation):
|
||
|
|
_, env, root = lab
|
||
|
|
if mutation == 'wrong-cluster': env['OPENBAO_EXPECTED_CLUSTER_UID'] = 'different-cluster'
|
||
|
|
elif mutation == 'configure-initial': env['OPENBAO_RUN_CONFIGURE_INITIAL'] = '1'
|
||
|
|
else:
|
||
|
|
data=json.loads(Path(env['OPENBAO_CONSOLE_METADATA']).read_text())
|
||
|
|
if mutation == 'missing-profile': data.pop('deployment_profile')
|
||
|
|
else: data['deployment_profile']='production'
|
||
|
|
Path(env['OPENBAO_CONSOLE_METADATA']).write_text(json.dumps(data))
|
||
|
|
r=invoke(lab)
|
||
|
|
assert r.returncode != 0
|
||
|
|
assert not (root/'fixture-state.json').exists()
|