coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin signing-lane writes to the verified primary cluster
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 16:41:46 +02:00
parent 5d288938f7
commit 80793afe4f
5 changed files with 59 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/state_hub_preflight_lane.py
View file

@ -19,6 +19,7 @@ FIELD = 'REPOSITORY_RENAME_PREFLIGHT_SECRET'
POLICY = 'workload-kv-read-state-hub-rename-preflight'
ROLE = 'state-hub-rename-preflight-eso'
SA = 'state-hub-preflight-eso'
CLUSTER_UID = 'a553c742-0115-43d4-99a4-a5ca56fe0786'
class LaneError(Exception):
@ -68,6 +69,12 @@ def approved_contract():
return expected, policy
def assert_cluster(kube):
namespace = data(command(kube + ['get', 'namespace', 'kube-system', '-o', 'json']))
if namespace.get('metadata', {}).get('uid') != CLUSTER_UID:
raise LaneError('primary_cluster_identity_mismatch')
def assert_fenced(kube):
deployment = data(command(kube + ['-n', 'state-hub', 'get', 'deployment', 'state-hub', '-o', 'json']))
pods = data(command(kube + ['-n', 'state-hub', 'get', 'pods', '-l', 'app=state-hub', '-o', 'json']))
@ -147,10 +154,11 @@ def verify_access(kube, receipt):
def run(args, receipt):
role, policy = approved_contract()
kube = ['kubectl', '--kubeconfig', args.kubeconfig]
assert_cluster(kube)
identity = data(bao(['token', 'lookup', '-format=json']))['data']
if 'platform-admin' not in identity['policies'] or 'root' in identity['policies']:
raise LaneError('attended_platform_admin_required')
kube = ['kubectl', '--kubeconfig', args.kubeconfig]
if args.action == 'verify':
verify_access(kube, receipt)
receipt['status'] = 'custody_verified_pending_eso_and_api_acceptance'