tegwick
1cdc18f75f
The executor logs in separately for the bind write (CCR-2026-0058) and the journey read (CCR-2026-0059) and refuses one role for both; every login is revoked at exit, also when setup fails. Clients log in again (re-reading the rotating projected JWT) before the lease ends, since a run's budget (20m) outlasts a 15m token. Synthetic pilot with per-lane tokens: completed and reverted, all_met. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
117 lines
5 KiB
Python
117 lines
5 KiB
Python
#!/usr/bin/env python3
|
|
"""Run one admission (NK-WP-0056-T13): the entry point of the rapp-bounded-executor Job.
|
|
|
|
python3 bounded-executor/cli.py --admission FILE --approval-id ID --config FILE [--result FILE]
|
|
|
|
The config (JSON, non-secret) names endpoints, token files and the pilot's targets:
|
|
|
|
executor_identity, runtime_principal, tenant, environment, approver_subjects{name: subject_id},
|
|
trust_satisfied[...] trust states the operator attests for this run (recorded)
|
|
approval_engine{url, token_file, ca_file?}
|
|
audit_core{url, token_file, ca_file?}
|
|
openbao{addr, k8s_role, jwt_file, ca_file?} bind write role (CCR-2026-0058); jwt_file: audience-openbao token
|
|
lldap{url, ca_file?, set_password: "/app/lldap_set_password"}
|
|
kubernetes{namespace, external_secret, deployment}
|
|
bind{kv, user}, journey{kv, k8s_role, config{...}} journey read role (CCR-2026-0059): one login per lane
|
|
|
|
Exit codes: 0 completed, 3 reverted, 4 refused before any effect, 5 stopped / unknown / revert failed / budget,
|
|
6 consumed but not in custody. The result printed is value-free.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import importlib.util
|
|
import json
|
|
import pathlib
|
|
import sys
|
|
|
|
HERE = pathlib.Path(__file__).resolve().parent
|
|
|
|
|
|
def _load(name):
|
|
spec = importlib.util.spec_from_file_location(name, HERE / f"{name}.py")
|
|
module = importlib.util.module_from_spec(spec)
|
|
sys.modules[name] = module
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
X = _load("executor")
|
|
OPS = _load("operations")
|
|
C = _load("clients")
|
|
EXIT = {"completed": 0, "reverted": 3, "refused": 4}
|
|
|
|
|
|
def build(cfg: dict, logins: list):
|
|
"""`logins` collects every OpenBao client as soon as it exists, so the caller revokes them all, even when a
|
|
later step of setup fails."""
|
|
o = cfg["openbao"]
|
|
if cfg["journey"]["k8s_role"] == o["k8s_role"]:
|
|
raise ValueError("the journey read and the bind write must use separate roles")
|
|
|
|
def login(role: str):
|
|
client = OPS.OpenBao(o["addr"], k8s_role=role, jwt_file=o["jwt_file"], ca_file=o.get("ca_file"))
|
|
logins.append(client)
|
|
return client
|
|
|
|
bao = login(o["k8s_role"])
|
|
journey_bao = login(cfg["journey"]["k8s_role"])
|
|
directory = OPS.Directory(cfg["lldap"]["url"], [cfg["lldap"].get("set_password", "/app/lldap_set_password")],
|
|
ca_file=cfg["lldap"].get("ca_file"))
|
|
kube = OPS.Kube()
|
|
k = cfg["kubernetes"]
|
|
operations, checks = OPS.pilot_registry(
|
|
bao=bao, journey_bao=journey_bao, directory=directory, delivery=OPS.KubeDelivery(kube, k["namespace"], k["external_secret"]),
|
|
restart=OPS.KubeRestart(kube, k["namespace"], k["deployment"]), bind_kv=cfg["bind"]["kv"],
|
|
bind_user=cfg["bind"]["user"], journey_kv=cfg["journey"]["kv"], journey_config=cfg["journey"]["config"])
|
|
trusted = set(cfg.get("trust_satisfied", []))
|
|
|
|
def alert(kind: str, info: dict) -> None:
|
|
print(json.dumps({"alert": kind, **info}), file=sys.stderr, flush=True)
|
|
|
|
deps = X.Deps(carrier=C.ApprovalEngine(cfg["approval_engine"]["url"], cfg["approval_engine"]["token_file"],
|
|
cfg["approval_engine"].get("ca_file")),
|
|
operations=operations, checks=checks, trust=lambda state: state in trusted,
|
|
audit=C.AuditCore(cfg["audit_core"]["url"], cfg["audit_core"]["token_file"],
|
|
cfg["audit_core"].get("ca_file")),
|
|
alert=alert)
|
|
config = X.Config(executor_identity=cfg["executor_identity"], runtime_principal=cfg["runtime_principal"],
|
|
tenant=cfg["tenant"], environment=cfg["environment"],
|
|
approver_subjects=dict(cfg["approver_subjects"]))
|
|
return config, deps
|
|
|
|
|
|
def exit_code(result: dict) -> int:
|
|
if result.get("reason") in ("receipt_not_in_custody", "audit_unavailable") and result["outcome"] != "refused":
|
|
return 6
|
|
return EXIT.get(result["outcome"], 5)
|
|
|
|
|
|
def main(argv=None) -> int:
|
|
parser = argparse.ArgumentParser(description=__doc__.split("\n", 1)[0])
|
|
parser.add_argument("--admission", required=True)
|
|
parser.add_argument("--approval-id", required=True)
|
|
parser.add_argument("--config", required=True)
|
|
parser.add_argument("--result", help="also write the result here")
|
|
args = parser.parse_args(argv)
|
|
cfg = json.loads(pathlib.Path(args.config).read_text())
|
|
admission = X.bea.load(pathlib.Path(args.admission))
|
|
logins: list = []
|
|
try:
|
|
config, deps = build(cfg, logins)
|
|
result = X.Run(admission, args.approval_id, config, deps).execute()
|
|
except Exception as error: # setup failed before preflight: nothing was consumed
|
|
result = {"outcome": "refused", "reason": "setup:" + type(error).__name__, "run_id": None, "effects": False}
|
|
finally:
|
|
for client in logins:
|
|
client.revoke_self()
|
|
text = json.dumps(result, indent=2, sort_keys=True)
|
|
if args.result:
|
|
pathlib.Path(args.result).write_text(text + "\n")
|
|
print(text)
|
|
return exit_code(result)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|