coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0046-T06: eso.token-renewal assurance signal; plan finished
Some checks are pending
CI Smoke / container-smoke (push) Waiting to run
Details
CI Smoke / host-smoke (push) Successful in 0s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex 2026-09-24 00:48:24 +02:00
parent 8f7aa1bb77
commit 52224b84f8
5 changed files with 60 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
scripts/capture_service_observation.py
View file

@ -36,6 +36,21 @@ def memory_bytes(value):
return float(match.group(1)) * multipliers[unit]
def renewal_signal(status, now):
"""Classify eso-token-renewer CronJob status (RPF-WP-0046) from timestamps only."""
success = status.get('lastSuccessfulTime') or ''
scheduled = status.get('lastScheduleTime') or ''
if not success:
return 'unavailable', now.isoformat()
succeeded_at = datetime.fromisoformat(success.replace('Z', '+00:00'))
if scheduled:
scheduled_at = datetime.fromisoformat(scheduled.replace('Z', '+00:00'))
# A newer scheduled run that has not succeeded within an hour failed.
if (scheduled_at - succeeded_at).total_seconds() > 3600 and (now - scheduled_at).total_seconds() > 3600:
return 'fail', scheduled
return 'pass', success
def capture():
contract = read_contract(ROOT / 'assurance/service-contract.json')
uid = query(['get', 'namespace', 'kube-system', '-o', 'go-template={{printf "%q" .metadata.uid}}'])
@ -94,6 +109,13 @@ def capture():
except (ValueError, KeyError, TypeError, subprocess.TimeoutExpired):
add('eso.ready', 'unavailable')
add('eso.refresh', 'unavailable')
try:
status = query(['get', 'cronjob', 'eso-token-renewer', '-n', 'external-secrets', '-o',
'go-template={"lastSuccessfulTime":{{printf "%q" (or .status.lastSuccessfulTime "")}},"lastScheduleTime":{{printf "%q" (or .status.lastScheduleTime "")}}}'])
result, when = renewal_signal(status, datetime.now(timezone.utc))
add('eso.token-renewal', result, when)
except (ValueError, KeyError, TypeError, subprocess.TimeoutExpired):
add('eso.token-renewal', 'unavailable')
# No token, Secret, application data/logs or seal/unseal mutation.
# Receipt timestamps are preserved; reads never renew recovery evidence.
signals.update(recovery_signals(datetime.now(timezone.utc)))