tegwick
216a5db55c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
36 lines
2.4 KiB
Bash
Executable file
36 lines
2.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# NK-WP-0056-T06 founder-run pilot: open the window, run one admission, ALWAYS close the window.
|
|
# sso-mfa/k8s/bounded-executor/pilot-run.sh ADMISSION_FILE APPROVAL_ID EVIDENCE_DIR
|
|
# Needs an attended `bao login -method=oidc -path=netkingdom role=platform-admin` in this shell first, and the
|
|
# approval already approved in informed-decision by the admission's approver. Prints value-free results only.
|
|
# The close runs from an EXIT trap, so a failed or interrupted run never leaves the write role open
|
|
# (2026-11-05: a diagnostic window stayed open overnight).
|
|
set -euo pipefail
|
|
A=${1:?admission file}; APPROVAL=${2:?approval id}; E=${3:?evidence dir}
|
|
NK=$HOME/net-kingdom; RAPP=$HOME/rapp-bounded-executor; PLAT=$HOME/railiance-platform
|
|
K="kubectl --kubeconfig $HOME/.kube/config-railiance01"
|
|
export BAO_ADDR=${BAO_ADDR:-http://127.0.0.1:18200} VAULT_ADDR=${VAULT_ADDR:-http://127.0.0.1:18200}
|
|
mkdir -p "$E"
|
|
ID=$(python3 -c "import yaml,sys; print(yaml.safe_load(open(sys.argv[1]))['spec']['id'])" "$A")
|
|
JOB=bounded-executor-$(echo "$ID" | tr 'A-Z' 'a-z')
|
|
W=$(sha256sum "$PLAT"/credential-change-requests/CCR-2026-0058-*.yaml | cut -d' ' -f1)
|
|
J=$(sha256sum "$PLAT"/credential-change-requests/CCR-2026-0059-*.yaml | cut -d' ' -f1)
|
|
n=$(ls "$E" 2>/dev/null | wc -l)
|
|
close() {
|
|
python3 "$NK/tools/service-binds/executor-lanes.py" window-close --admission "$A" --receipt "$E/$(printf %02d $((n + 3)))-window-close.json" || true
|
|
}
|
|
python3 "$NK/tools/service-binds/executor-lanes.py" window-open --admission "$A" --write-ccr-sha256 "$W" \
|
|
--journey-ccr-sha256 "$J" --receipt "$E/$(printf %02d $((n + 1)))-window-open.json"
|
|
trap close EXIT
|
|
CFG=$(mktemp --suffix=.json)
|
|
python3 -c "import json,sys; c=json.load(open(sys.argv[1])); c['trust_satisfied']=['runtime_secret_trust','runtime_identity_trust']; json.dump(c, open(sys.argv[2],'w'), indent=2)" "$RAPP/examples/config.pilot.json" "$CFG"
|
|
$K -n sso delete job "$JOB" --ignore-not-found >/dev/null; $K -n sso delete configmap "$JOB" --ignore-not-found >/dev/null
|
|
(cd "$RAPP" && make run ADMISSION="$A" APPROVAL_ID="$APPROVAL" CONFIG="$CFG" KUBECTL="$K")
|
|
# Either condition ends the wait (kubectl wait ANDs repeated --for; seen 2026-11-05, the completed run hung it).
|
|
for _ in $(seq 1 300); do
|
|
st=$($K -n sso get "job/$JOB" -o jsonpath='{.status.succeeded}{.status.failed}')
|
|
[ -n "$st" ] && break
|
|
sleep 5
|
|
done
|
|
$K -n sso logs "job/$JOB" > "$E/$(printf %02d $((n + 2)))-result.json"
|
|
tail -40 "$E/$(printf %02d $((n + 2)))-result.json"
|