coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare bounded State Hub preflight signing lane
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 11:50:27 +02:00
parent 234b1b559f
commit a46a6d8213
10 changed files with 501 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

35
scripts/credential-change.py
View file

@ -236,6 +236,8 @@ def validate_workload_kv_read(ccr: dict[str, Any], errors: list[str], warnings:
policy_file = require_string(
openbao.get("policy_file"), "openbao.policy_file", errors
)
if "metadata_read" in openbao and not isinstance(openbao["metadata_read"], bool):
errors.append("openbao.metadata_read must be boolean")
fields = [str(field) for field in require_list(openbao.get("fields"), "openbao.fields", errors)]
if not fields:
errors.append("openbao.fields must contain at least one field")
@ -264,6 +266,14 @@ def validate_workload_kv_read(ccr: dict[str, Any], errors: list[str], warnings:
if method in {"oidc", "kubernetes"}:
require_string(auth.get("mount"), "openbao.auth.mount", errors)
require_string(auth.get("role"), "openbao.auth.role", errors)
if method == "kubernetes":
if "audience" in auth:
require_string(auth["audience"], "openbao.auth.audience", errors)
for key in ("token_max_ttl", "token_explicit_max_ttl"):
if key in auth and (not isinstance(auth[key], str) or not TTL_RE.match(auth[key])):
errors.append(f"openbao.auth.{key} must be a TTL string")
if "token_no_default_policy" in auth and not isinstance(auth["token_no_default_policy"], bool):
errors.append("openbao.auth.token_no_default_policy must be boolean")
if method == "oidc":
redirect_uris = require_list(
auth.get("allowed_redirect_uris"),
@ -529,14 +539,12 @@ def generated_policy_hcl(ccr: dict[str, Any]) -> str:
openbao = ccr["openbao"]
mount = openbao["mount"]
suffix = openbao["kv_path"][len(mount) + 1 :]
return (
f'path "{mount}/data/{suffix}" {{\n'
' capabilities = ["read"]\n'
"}\n\n"
f'path "{mount}/metadata/{suffix}" {{\n'
' capabilities = ["read"]\n'
"}\n"
)
body = (f'path "{mount}/data/{suffix}" {{\n'
' capabilities = ["read"]\n' "}\n")
if openbao.get("metadata_read", True):
body += (f'\npath "{mount}/metadata/{suffix}" {{\n'
' capabilities = ["read"]\n' "}\n")
return body
@ -598,14 +606,17 @@ def auth_payload(ccr: dict[str, Any]) -> dict[str, Any]:
auth = ccr["openbao"]["auth"]
if auth["method"] == "kubernetes":
claims = auth["bound_claims"]
return {
payload = {
"bound_service_account_names": claims.get("service_account_names", []),
"bound_service_account_namespaces": claims.get(
"service_account_namespaces", []
),
"bound_service_account_namespaces": claims.get("service_account_namespaces", []),
"policies": ",".join(auth["policies"]),
"ttl": auth.get("ttl", "15m"),
}
for key in ("audience", "token_max_ttl", "token_explicit_max_ttl", "token_no_default_policy"):
if key in auth:
payload[key] = auth[key]
return payload
payload: dict[str, Any] = {
"role_type": "oidc",