coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow bounded ESO token self-validation and cleanup
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 16:47:26 +02:00
parent 238d261536
commit 9c86983f1a
5 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/credential-change.py
View file

@ -238,6 +238,8 @@ def validate_workload_kv_read(ccr: dict[str, Any], errors: list[str], warnings:
)
if "metadata_read" in openbao and not isinstance(openbao["metadata_read"], bool):
errors.append("openbao.metadata_read must be boolean")
if "token_self_lifecycle" in openbao and not isinstance(openbao["token_self_lifecycle"], bool):
errors.append("openbao.token_self_lifecycle must be boolean")
fields = [str(field) for field in require_list(openbao.get("fields"), "openbao.fields", errors)]
if not fields:
errors.append("openbao.fields must contain at least one field")
@ -544,6 +546,9 @@ def generated_policy_hcl(ccr: dict[str, Any]) -> str:
if openbao.get("metadata_read", True):
body += (f'\npath "{mount}/metadata/{suffix}" {{\n'
' capabilities = ["read"]\n' "}\n")
if openbao.get("token_self_lifecycle", False):
body += ('\npath "auth/token/lookup-self" {\n capabilities = ["read"]\n}\n'
'\npath "auth/token/revoke-self" {\n capabilities = ["update"]\n}\n')
return body