coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow bounded ESO token self-validation and cleanup
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 16:47:26 +02:00
parent 238d261536
commit 9c86983f1a
5 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/state_hub_preflight_lane.py
View file

@ -61,7 +61,8 @@ def approved_contract():
if (not auth['bound_claims_confirmed'] or ccr['openbao']['kv_path'] != KV
or ccr['openbao']['fields'] != [FIELD] or auth['role'] != ROLE
or auth['mount'] != 'kubernetes' or module.auth_payload(ccr) != expected
or ccr['openbao'].get('metadata_read') is not False):
or ccr['openbao'].get('metadata_read') is not False
or ccr['openbao'].get('token_self_lifecycle') is not True):
raise LaneError('exact_contract_required')
policy = module.generated_policy_hcl(ccr)
if (ROOT / ccr['openbao']['policy_file']).read_text() != policy:
@ -159,6 +160,15 @@ def run(args, receipt):
identity = data(bao(['token', 'lookup', '-format=json']))['data']
if 'platform-admin' not in identity['policies'] or 'root' in identity['policies']:
raise LaneError('attended_platform_admin_required')
if args.action == 'repair-policy':
current = data(bao(['read', '-format=json', 'sys/policies/acl/' + POLICY]))['data']['policy']
original = policy.split('\npath "auth/token/lookup-self"')[0]
if current not in {original, policy}:
raise LaneError('read_policy_drift')
bao(['write', 'sys/policies/acl/' + POLICY, '-'], payload={'policy': policy})
verify_access(kube, receipt)
receipt['status'] = 'custody_verified_pending_eso_and_api_acceptance'
return
if args.action == 'verify':
verify_access(kube, receipt)
receipt['status'] = 'custody_verified_pending_eso_and_api_acceptance'
@ -198,7 +208,7 @@ def run(args, receipt):
def main():
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument('action', choices=['provision', 'rotate', 'verify'])
parser.add_argument('action', choices=['provision', 'rotate', 'verify', 'repair-policy'])
parser.add_argument('--expected-version', required=True, type=int)
parser.add_argument('--kubeconfig', required=True)
parser.add_argument('--receipt', required=True)