coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Route railiance01 admin kubeconfig through an attended lane

Browse source 
Assistant: grok
Assistant-Session: 01a1625d-4770-76a0-8dee-7f5c514a47eb
This commit is contained in:
tegwick 2026-10-22 08:53:33 +02:00
parent 97c2e3533d
commit 537d551ef2
7 changed files with 94 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/check_agent_read_boundary.py
View file

@ -79,8 +79,15 @@ def denied_data_paths(policy_text: str) -> set[str]:
def to_data_path(path_template: str) -> str | None:
"""Catalog path -> KV v2 data path. `<mount>/rest` -> `<mount>/data/rest`."""
if PLACEHOLDER.search(path_template) or " " in path_template:
"""Catalog path -> KV v2 data path. `<mount>/rest` -> `<mount>/data/rest`.
An absolute filesystem path is not a KV mount.
"""
if (
PLACEHOLDER.search(path_template)
or " " in path_template
or path_template.startswith("/")
):
return None
mount, _, rest = path_template.partition("/")
return f"{mount}/data/{rest}" if rest else None

9
scripts/emit_high_risk_paths.py
View file

@ -118,7 +118,14 @@ def build() -> tuple[str, int]:
def _to_data_path(template: str) -> str | None:
import re
if re.search(r"[<>{}*]", template) or " " in template or template.startswith("k8s:"):
# A leading slash is a filesystem path, not an OpenBao mount. partition()
# would otherwise invent an empty mount and a fake `/data/...` address.
if (
re.search(r"[<>{}*]", template)
or " " in template
or template.startswith("k8s:")
or template.startswith("/")
):
return None
mount, _, rest = template.partition("/")
return f"{mount}/data/{rest}" if rest else None