coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T11: value-free OpenBao audit read for the executor write role, with synthetic-log tests

Browse source 
write-role-audit.py reads the file audit log on stdin and reports each interval in which
the write role existed, with logins, write-policy requests and failed kubernetes logins.
The pilot's own login is the positive control. Receipt holds times, counts and SA names only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-05 14:45:32 +01:00
parent a591262e51
commit c6199b8a6e
5 changed files with 294 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Makefile
View file

@ -213,7 +213,7 @@ execution-attribution-receipt-test: ## Receipt schema v0.1 validator; fixtures m
python3 -m pytest tools/execution-attribution-receipt/tests
bounded-executor-test: ## Bounded executor RBAC and declaration tests; the pilot admission inside its declared grants (NK-WP-0056-T03)
python3 -m pytest sso-mfa/k8s/bounded-executor bounded-executor/tests tests/test_executor_lanes.py
python3 -m pytest sso-mfa/k8s/bounded-executor bounded-executor/tests tests/test_executor_lanes.py tests/test_write_role_audit.py
python3 tools/service-identity/validate.py tools/service-identity/declarations/bounded-executor.yaml \
--admissions examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml