39 lines
1.4 KiB
Python
39 lines
1.4 KiB
Python
|
"""One configurable cluster route for bounded railiance01 proof scripts.
|
||
|
|
|
||
|
|
KUBECTL_ROUTE selects how a remote command reaches the railiance01 API:
|
||
|
|
|
||
|
|
* ``agent`` (default): ``ssh railiance01 <command>`` as the SSH login itself.
|
||
|
|
Since the CUST-WP-0073 cutover the agent login has no kubeconfig, so this
|
||
|
|
route fails closed for agents instead of silently escalating.
|
||
|
|
* ``founder-sudo``: ``ssh railiance01 sudo -n <command>``, the founder's
|
||
|
|
attended admin path (root reads the k3s kubeconfig). ``-n`` never prompts,
|
||
|
|
so stdin/stdout stay byte-clean pipes (no ``ssh -t``, which would merge
|
||
|
|
stderr into stdout and rewrite line endings).
|
||
|
|
|
||
|
|
Only these named routes exist; arbitrary shell is never accepted.
|
||
|
|
"""
|
||
|
|
import os
|
||
|
|
import shlex
|
||
|
|
|
||
|
|
SSH = ['ssh', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', 'railiance01']
|
||
|
|
ROUTES = {'agent': [], 'founder-sudo': ['sudo', '-n']}
|
||
|
|
|
||
|
|
|
||
|
|
def route_name(environ=None):
|
||
|
|
name = (os.environ if environ is None else environ).get('KUBECTL_ROUTE', 'agent')
|
||
|
|
if name not in ROUTES:
|
||
|
|
raise ValueError('unknown KUBECTL_ROUTE')
|
||
|
|
return name
|
||
|
|
|
||
|
|
|
||
|
|
def remote_prefix(environ=None):
|
||
|
|
return list(ROUTES[route_name(environ)])
|
||
|
|
|
||
|
|
|
||
|
|
def ssh_argv(remote_args, environ=None):
|
||
|
|
"""Local argv that runs ``remote_args`` on railiance01 through the selected route."""
|
||
|
|
remote_args = [str(a) for a in remote_args]
|
||
|
|
if not remote_args:
|
||
|
|
raise ValueError('remote command required')
|
||
|
|
return SSH + [shlex.join(remote_prefix(environ) + remote_args)]
|