coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin signing-lane writes to the verified primary cluster
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 16:41:46 +02:00
parent 5d288938f7
commit 80793afe4f
5 changed files with 59 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tests/test_state_hub_preflight_lane.py
View file

@ -69,6 +69,7 @@ class SigningLaneTests(unittest.TestCase):
args = SimpleNamespace(action='rotate', expected_version=1, kubeconfig='/fixture')
result = SimpleNamespace(stdout=json.dumps({'data': {'policies': ['platform-admin']}}).encode())
with patch.object(lane, 'approved_contract', return_value=({}, '')), \
patch.object(lane, 'assert_cluster'), \
patch.object(lane, 'bao', return_value=result), \
patch.object(lane, 'assert_fenced', side_effect=lane.LaneError('fence')), \
patch.object(lane.secrets, 'token_hex') as generate:
@ -76,6 +77,18 @@ class SigningLaneTests(unittest.TestCase):
lane.run(args, {})
generate.assert_not_called()
def test_wrong_cluster_precedes_any_openbao_access_or_generation(self):
args = SimpleNamespace(action='provision', expected_version=0, kubeconfig='/fixture')
response = SimpleNamespace(stdout=json.dumps({'metadata': {'uid': 'other-cluster'}}).encode())
with patch.object(lane, 'approved_contract', return_value=({}, '')), \
patch.object(lane, 'command', return_value=response), \
patch.object(lane, 'bao') as access, \
patch.object(lane.secrets, 'token_hex') as generate:
with self.assertRaisesRegex(lane.LaneError, 'primary_cluster_identity_mismatch'):
lane.run(args, {})
access.assert_not_called()
generate.assert_not_called()
def test_unapproved_key_format_or_policy_does_not_pass_contract(self):
import tempfile, yaml
ccr = copy.deepcopy(self.ccr)