coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T05: grant implemented in railiance-platform (4e60f69, 2e1ca67); net-kingdom copy removed, test reads the add-on, pins bumped; founder sync steps
All checks were successful
Bounded-execution contracts / contracts (push) Successful in 1m55s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 01:15:03 +01:00
parent e58d1c22fd
commit f56d0b2dc8
5 changed files with 47 additions and 105 deletions
Download patch file Download diff file Expand all files Collapse all files

17
tools/contract-tests/tests/test_agent_status_grant.py
View file

@ -1,15 +1,17 @@
"""NK-WP-0058-T05: the proposed agent status grant stays read-only and narrow, and what it can read holds no secret.
"""NK-WP-0058-T05: the agent status grant stays read-only and narrow, and what it can read holds no secret.
The grant (docs/proposals/2026-11-06-nk58-t05-agent-status-grant/rbac.yaml) is source only until decided. These
checks keep it from widening by accident, and keep the sso workloads it can read free of literal secret values:
`get` on a pod or Deployment returns its env, so a secret written there would become readable.
The grant is railiance-platform's add-on argocd/platform-addons/nk-agent-status/ (decision 4af1ec01, option A). Its
own guard is railiance-platform tests/test_nk_agent_status_rbac.py; this is net-kingdom's consumer-side check of the
same files, plus the sso workloads it can read: `get` on a pod or Deployment returns its env, so a literal secret
value there would become readable.
"""
from pathlib import Path
import pytest
import yaml
REPO = Path(__file__).resolve().parents[3]
GRANT = REPO / 'docs/proposals/2026-11-06-nk58-t05-agent-status-grant/rbac.yaml'
ADDON = REPO.parent / 'railiance-platform/argocd/platform-addons/nk-agent-status'
READ = {'get', 'list', 'watch'}
NEVER = {'secrets', 'pods/log', 'pods/exec', 'pods/attach', 'pods/portforward', 'serviceaccounts/token'}
ALLOWED = {('sso', 'batch', 'jobs'), ('sso', '', 'pods'), ('sso', 'apps', 'deployments'),
@ -25,7 +27,10 @@ def secret_named(name):
def docs():
return [d for d in yaml.safe_load_all(GRANT.read_text()) if d]
if not (ADDON / 'kustomization.yaml').exists():
pytest.skip('railiance-platform checkout with the nk-agent-status add-on required')
resources = yaml.safe_load((ADDON / 'kustomization.yaml').read_text())['resources']
return [d for r in resources for d in yaml.safe_load_all((ADDON / r).read_text()) if d]
def test_only_namespaced_read_rules_on_the_listed_resources():