coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: prepare core hub platform onboarding
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-08-20 11:18:30 +02:00
parent f19f89ae58
commit ac69f90300
8 changed files with 473 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
tests/test_credential_change.py
View file

@ -76,6 +76,34 @@ class CredentialChangeTests(unittest.TestCase):
self.assertEqual(errors, [])
self.assertEqual(ccr["target"]["rapp"], "rapp-qonto")
def test_core_hub_runtime_lane_is_split_and_agent_denied(self) -> None:
path = (
REPO_DIR
/ "credential-change-requests/CCR-2026-0013-core-hub-runtime-api-token.yaml"
)
ccr, errors, warnings = credential_change.validate_ccr(path)
self.assertEqual(errors, [])
self.assertEqual(ccr["target"]["rapp"], "rapp-core-hub")
self.assertEqual(ccr["openbao"]["fields"], ["CORE_HUB_API_TOKEN"])
self.assertNotIn("CORE_HUB_DATABASE_URL", ccr["openbao"]["fields"])
self.assertTrue(any("bound claim is not confirmed" in item for item in warnings))
boundary = (
REPO_DIR / "openbao/policies/agent-high-risk-boundary.hcl"
).read_text()
self.assertIn('path "platform/data/workloads/core-hub/runtime"', boundary)
self.assertRegex(
boundary,
r'path "platform/data/workloads/core-hub/runtime" \{\s*capabilities = \["deny"\]',
)
store = credential_change.load_yaml(
REPO_DIR
/ "argocd/platform-addons/openbao-secretstore/openbao-core-hub-runtime.clustersecretstore.yaml"
)
self.assertEqual(store["spec"]["provider"]["vault"]["path"], "platform")
self.assertEqual(store["spec"]["conditions"][0]["namespaces"], ["core-hub"])
def test_target_rapp_rejects_non_slug(self) -> None:
path = self.unapproved_ccr()
data = credential_change.load_yaml(path)