tegwick
c53de12f21
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
36 lines
1.5 KiB
Python
36 lines
1.5 KiB
Python
"""Row O5: the window watcher and its CCR name the same roles and identity (NK-WP-0058-T06)."""
|
|
import importlib.util
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
REPO = Path(__file__).resolve().parents[3]
|
|
CCRS = REPO.parent / 'railiance-platform' / 'credential-change-requests'
|
|
sys.path.insert(0, str(REPO / 'bounded-executor'))
|
|
spec = importlib.util.spec_from_file_location('window_watch_contract', REPO / 'bounded-executor/window_watch.py')
|
|
watch = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(watch)
|
|
|
|
|
|
def ccr(prefix):
|
|
files = sorted(CCRS.glob(prefix + '-*.yaml'))
|
|
if not files:
|
|
pytest.skip(f'railiance-platform {prefix} required')
|
|
return yaml.safe_load(files[0].read_text())
|
|
|
|
|
|
def test_watcher_logs_in_with_the_ccr_role_and_watches_the_write_role():
|
|
watch_ccr, write_ccr = ccr('CCR-2026-0064'), ccr('CCR-2026-0058')
|
|
auth = watch_ccr['openbao']['auth']
|
|
assert watch.WATCH_ROLE == auth['role']
|
|
assert watch.WRITE_ROLE == watch_ccr['openbao']['watch']['role'] == write_ccr['openbao']['auth']['role']
|
|
assert watch.ROLE_PATH == '/v1/auth/kubernetes/role/' + watch.WRITE_ROLE
|
|
assert auth['bound_claims'] == {'service_account_names': ['nk-window-watch'], 'service_account_namespaces': ['sso']}
|
|
assert auth['audience'] == 'openbao'
|
|
|
|
|
|
def test_flag_mode_matches_what_the_watcher_needs():
|
|
mode = ccr('CCR-2026-0064')['openbao']['watch']['mode']
|
|
assert mode in ('flag', 'close') # the CronJob's --mode must not need more than the CCR grants
|