tegwick
a5496170cf
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
83 lines
4.7 KiB
Python
83 lines
4.7 KiB
Python
#!/usr/bin/env python3
|
|
"""Migrate only the two reviewed baseline registrations; never export Secret values.
|
|
|
|
Runtime policy overrides are issuer-owned in its policy PVC. This migration is
|
|
for initial activation; subsequent changes use the authenticated policy journey.
|
|
"""
|
|
import argparse
|
|
import base64
|
|
import copy
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parent
|
|
spec = importlib.util.spec_from_file_location('config_pin', ROOT/'openbao-client-config.py')
|
|
pin = importlib.util.module_from_spec(spec); spec.loader.exec_module(pin)
|
|
CLIENTS = {'vergabe-demo-company', 'user-engine-portal'}
|
|
CLUSTER_UID = 'a553c742-0115-43d4-99a4-a5ca56fe0786'
|
|
|
|
class Refused(Exception): pass
|
|
|
|
def require(condition, reason):
|
|
if not condition: raise Refused(reason)
|
|
|
|
def replacement(secret):
|
|
try: raw,config,_ = pin.issuer_document(secret)
|
|
except Exception: raise Refused("issuer_configuration_unreadable") from None
|
|
clients = config.get('clients',[])
|
|
ids = [c.get('clientId') for c in clients]
|
|
require(len(ids)==len(set(ids)) and CLIENTS.issubset(ids), 'reviewed_clients_required')
|
|
document = yaml.compose(raw)
|
|
nodes = next(v for k,v in document.value if k.value=='clients')
|
|
edits=[]; expected=copy.deepcopy(config)
|
|
for index,client in enumerate(clients):
|
|
if client['clientId'] not in CLIENTS: continue
|
|
require(client.get('clientType')=='public' and client.get('grantTypes')==['authorization_code'], 'client_shape_changed')
|
|
require('mfaRequired' not in client, 'explicit_policy_requires_review')
|
|
if client.get('mfaOptional') is True: continue
|
|
require('mfaOptional' not in client, 'explicit_policy_requires_review')
|
|
node=nodes.value[index]
|
|
require(not node.flow_style, 'block_client_required')
|
|
column=node.value[0][0].start_mark.column
|
|
position=node.end_mark.index
|
|
line_start=raw.rfind('\n',0,position)+1
|
|
if not raw[line_start:position].strip(): position=line_start
|
|
addition=('' if position==0 or raw[position-1]=='\n' else '\n')+' '*column+'mfaOptional: true\n'
|
|
edits.append((position,addition));expected['clients'][index]['mfaOptional']=True
|
|
updated=raw
|
|
for position,addition in sorted(edits,reverse=True):updated=updated[:position]+addition+updated[position:]
|
|
require(yaml.load(updated,Loader=pin.UniqueLoader)==expected, 'unrelated_configuration_changed')
|
|
return base64.b64encode(updated.encode()).decode(),bool(edits)
|
|
|
|
def kube(args,payload=None):
|
|
result=subprocess.run(['kubectl','--request-timeout=20s',*args],input=json.dumps(payload) if payload is not None else None,capture_output=True,text=True,timeout=30)
|
|
require(result.returncode==0,'kubernetes_operation_failed')
|
|
return json.loads(result.stdout)
|
|
|
|
def run(args):
|
|
require(kube(['get','namespace','kube-system','-o','json'])['metadata']['uid']==CLUSTER_UID,'cluster_changed')
|
|
secret=kube(['-n','sso','get','secret','keycape-config','-o','json'])
|
|
require(not secret['metadata'].get('ownerReferences'),'controller_owned_configuration')
|
|
value,changed=replacement(secret);metadata=pin.safe_metadata(secret)
|
|
receipt={'clients':sorted(CLIENTS),'before':metadata,'change_needed':changed,'other_clients_unchanged':True,'secret_values_emitted':False,'mode':args.mode}
|
|
if args.mode=='inspect':return receipt
|
|
require(metadata=={'uid':args.expected_uid,'resource_version':args.expected_resource_version},'observed_revision_changed')
|
|
if changed:
|
|
patch=[{'op':'test','path':'/metadata/uid','value':metadata['uid']},{'op':'test','path':'/metadata/resourceVersion','value':metadata['resource_version']},{'op':'replace','path':'/data/config.yaml','value':value}]
|
|
command=['-n','sso','patch','secret','keycape-config','--type=json','--patch-file=/dev/stdin','-o','json']
|
|
if args.mode=='dry-run':command.append('--dry-run=server')
|
|
response=kube(command,patch)
|
|
require(response['data']==dict(secret['data'],**{'config.yaml':value}),'patch_readback_mismatch')
|
|
if args.mode=='apply':
|
|
response=kube(['-n','sso','get','secret','keycape-config','-o','json'])
|
|
require(response['metadata']['uid']==metadata['uid'] and response['data']==dict(secret['data'],**{'config.yaml':value}),'readback_changed')
|
|
receipt['after']=pin.safe_metadata(response)
|
|
return receipt
|
|
|
|
if __name__=='__main__':
|
|
parser=argparse.ArgumentParser();parser.add_argument('mode',choices=['inspect','dry-run','apply']);parser.add_argument('--expected-uid');parser.add_argument('--expected-resource-version')
|
|
try: print(json.dumps(run(parser.parse_args())))
|
|
except Refused as error:print(json.dumps({'success':False,'failure':str(error)}));raise SystemExit(1)
|