Establish attended telemetry Grafana custody and record private activation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

scripts/telemetry_grafana_access.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Silent attended Grafana API probe through a fixed localhost tunnel."""
+import argparse
+import base64
+import json
+import os
+import urllib.error
+import urllib.request
+
+from state_hub_preflight_lane import LaneError, bao, data
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--receipt', required=True)
+    args = parser.parse_args()
+    fd = os.open(args.receipt, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+    receipt = {'schema': 'rapp-telemetry.access.v1', 'status': 'failed'}
+    try:
+        policies = data(bao(['token', 'lookup', '-format=json']))['data']['policies']
+        if 'platform-admin' not in policies or 'root' in policies:
+            raise LaneError('attended_platform_admin_required')
+        opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+        def request(path, headers=None):
+            req = urllib.request.Request('http://127.0.0.1:13001' + path, headers=headers or {})
+            try:
+                with opener.open(req, timeout=10) as response:
+                    return response.status, json.load(response)
+            except urllib.error.HTTPError as error:
+                return error.code, None
+        for label, headers in [('anonymous_denied', {}), ('forged_proxy_denied', {
+                'X-WEBAUTH-USER': 'admin', 'Remote-User': 'admin', 'Remote-Groups': 'admins'})]:
+            if request('/api/user', headers)[0] != 401:
+                raise LaneError('negative_access_failed')
+            receipt[label] = True
+        native = data(bao(['read', '-format=json', 'platform/data/workloads/telemetry/grafana-admin']))['data']['data']
+        credential = base64.b64encode((native['ADMIN_USERNAME'] + ':' + native['ADMIN_PASSWORD']).encode()).decode()
+        headers = {'Authorization': 'Basic ' + credential}
+        status, user = request('/api/user', headers)
+        if status != 200 or user.get('login') != 'admin' or not user.get('isGrafanaAdmin'):
+            raise LaneError('positive_access_failed')
+        receipt['native_admin_authenticated'] = True
+        status, sources = request('/api/datasources', headers)
+        if status != 200 or not any(s['type'] == 'prometheus' for s in sources):
+            raise LaneError('datasource_missing')
+        receipt['prometheus_datasource_present'] = True
+        status, dashboards = request('/api/search?type=dash-db', headers)
+        if status != 200 or not dashboards:
+            raise LaneError('dashboards_missing')
+        receipt.update(status='verified', dashboard_count=len(dashboards))
+    except Exception:
+        receipt['error'] = 'access_verification_failed'
+    finally:
+        with os.fdopen(fd, 'w') as output:
+            json.dump(receipt, output, indent=2)
+    return 0 if receipt['status'] == 'verified' else 1
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

scripts/telemetry_grafana_custody.py

@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+"""Silent attended bootstrap of an exact Grafana-admin ESO lane."""
+import argparse
+import base64
+import json
+import os
+import re
+import secrets
+import sys
+from pathlib import Path
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from state_hub_preflight_lane import bao, command, data, assert_cluster, LaneError, capabilities, revoke
+from repair_eso_kubernetes_auth import role_payload, check_role, verify_login
+k = ['kubectl', '--kubeconfig', '/home/worsch/.kube/config-railiance01']
+lane = dict(service_account='telemetry-grafana-eso', namespace='telemetry', role='telemetry-grafana-eso', policy='telemetry-grafana-admin-eso', kv_path='platform/data/workloads/telemetry/grafana-admin')
+policy = 'path "' + lane['kv_path'] + '" { capabilities = ["read"] }\npath "auth/token/lookup-self" { capabilities = ["read"] }\npath "auth/token/revoke-self" { capabilities = ["update"] }\n'
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--receipt', required=True)
+    args = parser.parse_args()
+    fd = os.open(args.receipt, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+    receipt = {'schema': 'rapp-telemetry.custody.v1', 'status': 'failed'}
+
+    def absent(r):
+        return b'404' in r.stderr or b'No value found' in r.stderr
+    try:
+        assert_cluster(k)
+        identity = data(bao(['token', 'lookup', '-format=json']))['data']['policies']
+        if 'platform-admin' not in identity or 'root' in identity:
+            raise LaneError('wrong_identity')
+        boundary_path = 'sys/policies/acl/agent-high-risk-boundary'
+        current = data(bao(['read', '-format=json', boundary_path]))['data']['policy']
+        overlay = ''
+        for path in [lane['kv_path'], lane['kv_path'].replace('/data/', '/metadata/', 1)]:
+            stanza = 'path "' + path + '" { capabilities = ["deny"] }\n'
+            if '"' + path + '"' not in current:
+                overlay += stanza
+            elif not re.search(r'path\s+"' + re.escape(path) + r'"\s*\{\s*capabilities\s*=\s*\["deny"\]\s*\}', current):
+                raise LaneError('boundary_path_drift')
+        if overlay:
+            if data(bao(['read', '-format=json', boundary_path]))['data']['policy'] != current:
+                raise LaneError('boundary_drift')
+            bao(['write', boundary_path, '-'], payload={'policy': current + '\n' + overlay})
+            if data(bao(['read', '-format=json', boundary_path]))['data']['policy'] != current + '\n' + overlay:
+                raise LaneError('boundary_readback_failed')
+        r = bao(['read', '-format=json', lane['kv_path']], allow_failure=True)
+        if r.returncode:
+            if not absent(r):
+                raise LaneError('custody_absence_unproven')
+            bao(['write', lane['kv_path'], '-'], payload={'options': {'cas': 0}, 'data': {'ADMIN_USERNAME': 'admin', 'ADMIN_PASSWORD': secrets.token_urlsafe(48)}})
+        native = data(bao(['read', '-format=json', lane['kv_path']]))['data']
+        if set(native['data']) != {'ADMIN_USERNAME', 'ADMIN_PASSWORD'} or native['data']['ADMIN_USERNAME'] != 'admin' or len(native['data']['ADMIN_PASSWORD']) < 40:
+            raise LaneError('custody_drift')
+        for path, payload, checker in [('sys/policies/acl/' + lane['policy'], {'policy': policy}, lambda a: a['policy'] == policy), ('auth/kubernetes/role/' + lane['role'], role_payload(lane), None)]:
+            old = bao(['read', '-format=json', path], allow_failure=True)
+            if old.returncode:
+                if not absent(old):
+                    raise LaneError('object_absence_unproven')
+                bao(['write', path, '-'], payload=payload)
+            elif checker:
+                if not checker(data(old)['data']):
+                    raise LaneError('policy_drift')
+            else:
+                check_role(data(old)['data'], lane)
+        child = data(bao(['token', 'create', '-format=json', '-policy=' + lane['policy'], '-policy=agent-high-risk-boundary', '-no-default-policy', '-ttl=60s']))['auth']['client_token']
+        try:
+            paths = [lane['kv_path'], lane['kv_path'].replace('/data/', '/metadata/', 1)]
+            caps = capabilities(child, paths)
+            if any((caps[p] != ['deny'] for p in paths)):
+                raise LaneError('coding_agent_boundary_failed')
+            receipt['coding_agent_deny_wins'] = True
+        finally:
+            revoke(child)
+        verify_login(k, lane, receipt)
+        command(k + ['apply', '-f', '/home/worsch/rapp-telemetry/manifests/custody.yaml'])
+        command(k + ['wait', '--for=condition=Ready', 'clustersecretstore/openbao-telemetry-grafana', '--timeout=45s'])
+        command(k + ['-n', 'telemetry', 'wait', '--for=condition=Ready', 'externalsecret/telemetry-grafana-admin', '--timeout=45s'])
+        live = data(command(k + ['-n', 'telemetry', 'get', 'secret', 'telemetry-grafana-admin', '-o', 'json']))['data']
+        if base64.b64decode(live['admin-user']).decode() != native['data']['ADMIN_USERNAME'] or base64.b64decode(live['admin-password']).decode() != native['data']['ADMIN_PASSWORD']:
+            raise LaneError('delivery_mismatch')
+        receipt.update(status='verified', kv_version=native['metadata']['version'], custody='platform/workloads/telemetry/grafana-admin', delivery_matches=True)
+    except Exception:
+        receipt['error'] = 'custody_bootstrap_failed'
+    finally:
+        with os.fdopen(fd, 'w') as f:
+            json.dump(receipt, f, indent=2)
+    sys.exit(0 if receipt['status'] == 'verified' else 1)
+
+
+if __name__ == "__main__":
+    main()