coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Build audit-core AppRole lane after founder approval

Browse source 
reuse_policy leaves external-secrets-audit-core intact so database
leases keep working. AppRole delivered to Kubernetes; interim static
ESO token retired.
This commit is contained in:
tegwick 2026-08-13 10:42:59 +02:00
parent 93b9c1a027
commit 8e41f85121
3 changed files with 58 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/ops_mason/executor.py
View file

@ -53,6 +53,9 @@ class AppRoleKVSpec:
delivery_dir: Path | None = None
bao_bin: str = "bao"
audit_log_path: Path | None = None
# When True the named policy already exists (and may grant more than one
# KV path). Do not rewrite it — AppRole bind only.
reuse_policy: bool = False
@dataclass
@ -111,8 +114,9 @@ def build_approle_kv_lane(plan: ConstructionPlan, spec: AppRoleKVSpec) -> dict[s
f"approved_at={plan.approved_at!r}) — refusing to build"
)
policy_hcl = _policy_hcl(spec.kv_path, spec.kv_capabilities)
_run(spec.bao_bin, ["policy", "write", spec.policy_name, "-"], input_text=policy_hcl)
if not spec.reuse_policy:
policy_hcl = _policy_hcl(spec.kv_path, spec.kv_capabilities)
_run(spec.bao_bin, ["policy", "write", spec.policy_name, "-"], input_text=policy_hcl)
_run(
spec.bao_bin,