coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document recovered ESO lanes and recognize explicit invalid-token responses
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 18:51:40 +02:00
parent 153223983f
commit 3759850cc4
6 changed files with 78 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/repair_eso_kubernetes_auth.py
View file

@ -30,6 +30,13 @@ def check_role(actual, lane):
require(not actual.get('token_period') and not actual.get('bound_service_account_namespace_selector'), 'role_drift')
def invalid_token_lookup(result):
error = result.stderr.lower()
return (result.returncode != 0 and (b'400' in error or b'403' in error)
and (b'bad token' in error or b'invalid token' in error)
and b'permission denied' not in error)
def compare_custody(kube, lane):
es = data(command(kube + ['-n', lane['namespace'], 'get', 'externalsecret', lane['name'], '-o', 'json']))
require(es['spec']['secretStoreRef'] == {'kind': 'ClusterSecretStore', 'name': lane['store']}, 'external_secret_store_drift')
@ -153,7 +160,7 @@ def run(args, receipt):
revoke(old_token)
row['retired_token_revoked'] = True
else:
require(b'400' in lookup.stderr and (b'bad token' in lookup.stderr.lower() or b'invalid token' in lookup.stderr.lower()), 'retired_token_invalidity_unproven')
require(invalid_token_lookup(lookup), 'retired_token_invalidity_unproven')
row['retired_token_already_invalid'] = True
check = bao(['token', 'lookup', '-format=json'], token=old_token, allow_failure=True)
require(check.returncode != 0 and b'403' in check.stderr, 'retired_token_denial_unproven')