coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Establish scoped KeyCape factor custody and verified automatic renewal
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
KeyCape factor custody acceptance / acceptance (push) Successful in 7s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
codex 2026-09-13 16:25:33 +02:00
parent b75729b799
commit 2e2c31d237
22 changed files with 1169 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

34
scripts/keycape_factor_renewal_metadata.py Normal file
View file

@ -0,0 +1,34 @@
#!/usr/bin/env python3
"""Exact reviewed renewal metadata; owner-admin operation, not generic KV-read delegation."""
import argparse,json,os
from pathlib import Path
from keycape_factor_metadata import call,normalized,policy_text
ROOT=Path(__file__).resolve().parents[1]
NAME="keycape-factor-renewer"
ROLE={"bound_service_account_names":[NAME],"bound_service_account_namespaces":["sso"],"audience":"openbao","token_policies":[NAME],"token_ttl":300,"token_max_ttl":300,"token_no_default_policy":True}
def execute():
policy=(ROOT/"openbao/policies"/(NAME+".hcl")).read_text()
existing=call("policy","list","-format=json")
if NAME in existing:
if normalized(policy_text(call("policy","read","-format=json",NAME)))!=normalized(policy):raise RuntimeError("existing renewal policy differs")
else:call("write","-format=json","sys/policies/acl/"+NAME,"-",payload={"policy":policy})
roles=call("list","-format=json","auth/kubernetes/role")
names=roles if isinstance(roles,list) else roles.get("data",{}).get("keys",[])
path="auth/kubernetes/role/"+NAME
if NAME in names:
data=call("read","-format=json",path)["data"]
if any(data.get(k)!=v for k,v in ROLE.items()):raise RuntimeError("existing renewal role differs")
else:call("write","-format=json",path,"-",payload=ROLE)
data=call("read","-format=json",path)["data"]
if any(data.get(k)!=v for k,v in ROLE.items()):raise RuntimeError("renewal role readback failed")
if normalized(policy_text(call("policy","read","-format=json",NAME)))!=normalized(policy):raise RuntimeError("renewal policy readback failed")
return {"success":True,"policy":NAME,"role":path,"token_max_ttl":300,"secret_values_read":False,"secret_values_written":False}
def main():
p=argparse.ArgumentParser();p.add_argument("--receipt",type=Path,required=True);a=p.parse_args()
if any(os.environ.get(k) for k in ["VAULT_TOKEN","BAO_TOKEN","OPENBAO_TOKEN"]):return 2
fd=os.open(a.receipt,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600);result={"success":False}
try:result=execute();return 0
except RuntimeError as e:result["failure"]=str(e);return 1
except Exception as e:result["failure_type"]=type(e).__name__;return 1
finally:os.write(fd,json.dumps(result,indent=2).encode());os.close(fd)
if __name__=="__main__":raise SystemExit(main())