tegwick
80d280a340
Ingress: each owner's NetworkPolicies admit the executor pod (small evaluator, synthetic cases). Custody names: KeyCape client secret (C4) and audit sender (C5) agree across net-kingdom, railiance-platform and audit-core. E7: one LLDAP digest for the executor tool and the server. 95 tests pass in a CI-like layout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
21 lines
1.1 KiB
Python
21 lines
1.1 KiB
Python
"""Row E7: the executor's lldap_set_password comes from the LLDAP image the sso server runs (NK-WP-0058-T02).
|
|
|
|
The executor image copies /app/lldap_set_password from a digest-pinned LLDAP image (bounded-executor/Containerfile).
|
|
The tool speaks LLDAP's OPAQUE protocol, so it must be the server's own version: the two digests must be equal.
|
|
"""
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
REPO = Path(__file__).resolve().parents[3]
|
|
DIGEST = r'docker\.io/lldap/lldap@(sha256:[0-9a-f]{64})'
|
|
|
|
|
|
def test_executor_tool_matches_the_lldap_server():
|
|
tool = re.findall(DIGEST, (REPO / 'bounded-executor/Containerfile').read_text())
|
|
deployment = next(d for d in yaml.safe_load_all((REPO / 'sso-mfa/k8s/lldap/deployment.yaml').read_text())
|
|
if d and d.get('kind') == 'Deployment')
|
|
server = [m for c in deployment['spec']['template']['spec']['containers'] for m in re.findall(DIGEST, c['image'])]
|
|
assert len(tool) == 1 and len(server) == 1, (tool, server)
|
|
assert tool == server, 'the executor image would copy lldap_set_password from another LLDAP version'
|