coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T06: pilot-run.sh, window open, run, and an EXIT-trap window close (a diagnostic window stayed open overnight)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
This commit is contained in:
tegwick 2026-11-05 09:27:47 +01:00
parent c865077580
commit e181fb0cfb
1 changed files with 31 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
sso-mfa/k8s/bounded-executor/pilot-run.sh Executable file
View file

@ -0,0 +1,31 @@
#!/usr/bin/env bash
# NK-WP-0056-T06 founder-run pilot: open the window, run one admission, ALWAYS close the window.
# sso-mfa/k8s/bounded-executor/pilot-run.sh ADMISSION_FILE APPROVAL_ID EVIDENCE_DIR
# Needs an attended `bao login -method=oidc -path=netkingdom role=platform-admin` in this shell first, and the
# approval already approved in informed-decision by the admission's approver. Prints value-free results only.
# The close runs from an EXIT trap, so a failed or interrupted run never leaves the write role open
# (2026-11-05: a diagnostic window stayed open overnight).
set -euo pipefail
A=${1:?admission file}; APPROVAL=${2:?approval id}; E=${3:?evidence dir}
NK=$HOME/net-kingdom; RAPP=$HOME/rapp-bounded-executor; PLAT=$HOME/railiance-platform
K="kubectl --kubeconfig $HOME/.kube/config-railiance01"
export BAO_ADDR=${BAO_ADDR:-http://127.0.0.1:18200} VAULT_ADDR=${VAULT_ADDR:-http://127.0.0.1:18200}
mkdir -p "$E"
ID=$(python3 -c "import yaml,sys; print(yaml.safe_load(open(sys.argv[1]))['spec']['id'])" "$A")
JOB=bounded-executor-$(echo "$ID" | tr 'A-Z' 'a-z')
W=$(sha256sum "$PLAT"/credential-change-requests/CCR-2026-0058-*.yaml | cut -d' ' -f1)
J=$(sha256sum "$PLAT"/credential-change-requests/CCR-2026-0059-*.yaml | cut -d' ' -f1)
n=$(ls "$E" 2>/dev/null | wc -l)
close() {
python3 "$NK/tools/service-binds/executor-lanes.py" window-close --admission "$A" --receipt "$E/$(printf %02d $((n + 3)))-window-close.json" || true
}
python3 "$NK/tools/service-binds/executor-lanes.py" window-open --admission "$A" --write-ccr-sha256 "$W" \
--journey-ccr-sha256 "$J" --receipt "$E/$(printf %02d $((n + 1)))-window-open.json"
trap close EXIT
CFG=$(mktemp --suffix=.json)
python3 -c "import json,sys; c=json.load(open(sys.argv[1])); c['trust_satisfied']=['runtime_secret_trust','runtime_identity_trust']; json.dump(c, open(sys.argv[2],'w'), indent=2)" "$RAPP/examples/config.pilot.json" "$CFG"
$K -n sso delete job "$JOB" --ignore-not-found >/dev/null; $K -n sso delete configmap "$JOB" --ignore-not-found >/dev/null
(cd "$RAPP" && make run ADMISSION="$A" APPROVAL_ID="$APPROVAL" CONFIG="$CFG" KUBECTL="$K")
$K -n sso wait --for=condition=complete --for=condition=failed "job/$JOB" --timeout=1500s
$K -n sso logs "job/$JOB" > "$E/$(printf %02d $((n + 2)))-result.json"
tail -40 "$E/$(printf %02d $((n + 2)))-result.json"