{ "apiVersion": "v1", "kind": "List", "items": [ { "apiVersion": "v1", "kind": "ConfigMap", "metadata": { "name": "infd-requester-proof", "namespace": "informed-decision" }, "data": { "proof.py": "\"\"\"Temporary native proof. Emits only fixed phases and booleans; never raw failures.\"\"\"\nimport base64\nimport json\nimport stat\nimport sys\nfrom pathlib import Path\nfrom urllib.parse import urlencode, quote_plus\nfrom urllib.request import Request, build_opener, ProxyHandler, HTTPRedirectHandler\nfrom urllib.error import HTTPError\nfrom informed_decision.requester import RequesterTokenProvider, CLIENT_ID\nfrom informed_decision.http_transport import JSONTransport\n\nBAO = 'http://openbao.openbao.svc:8200/v1/'\nISSUER = 'https://kc.coulomb.social'\nROLE = 'informed-decision-sitting-requester-eso'\nPOLICY = 'workload-kv-read-informed-decision-sitting-requester-eso'\nSECRET = Path('/var/run/secrets/informed-decision/requester/client-secret')\n\nclass NoRedirect(HTTPRedirectHandler):\n def redirect_request(self, *args, **kwargs): return None\n\ndef http(method, url, body=None, token=None, form=False, client_auth=None):\n headers = {'Content-Type': 'application/x-www-form-urlencoded' if form else 'application/json'}\n if token: headers['X-Vault-Token'] = token\n if client_auth: headers['Authorization'] = 'Basic ' + client_auth\n raw = body if form else (json.dumps(body).encode() if body is not None else None)\n req = Request(url, data=raw, headers=headers, method=method)\n try: response = build_opener(ProxyHandler({}), NoRedirect()).open(req, timeout=5)\n except HTTPError as error: response = error\n with response:\n status = response.code\n content = response.read(262145)\n if len(content) > 262144: raise ValueError()\n return status, json.loads(content) if content else {}\n\ndef run(negative=False):\n receipt = {'complete': False, 'phase': 'start', 'negative_identity': negative}\n token = None\n def check(name, condition):\n receipt['phase'] = name\n receipt[name] = bool(condition)\n if not condition: raise ValueError()\n try:\n receipt['phase'] = 'login'\n status, result = http('POST', BAO+'auth/kubernetes/login',\n {'role': ROLE, 'jwt': Path('/identity/openbao').read_text()})\n if status == 200: token = result.get('auth', {}).get('client_token')\n if negative:\n check('wrong_identity_refused', status == 403 and token is None)\n else:\n auth = result.get('auth', {})\n check('exact_identity', status == 200 and bool(token)\n and auth.get('metadata', {}).get('service_account_name') == 'informed-decision-eso'\n and auth.get('metadata', {}).get('service_account_namespace') == 'informed-decision')\n status, result = http('GET', BAO+'auth/token/lookup-self', token=token)\n data = result.get('data', {})\n check('exact_policy_and_ttl', status == 200 and data.get('policies') == [POLICY]\n and not data.get('identity_policies') and 0 < data.get('ttl', 0) <= 900\n and data.get('creation_ttl') == 900 and data.get('explicit_max_ttl') == 900)\n status, _ = http('GET', BAO+'platform/data/workloads/secrets-engine/approval-requester', token=token)\n check('sibling_get_refused', status == 403)\n status, _ = http('LIST', BAO+'platform/metadata/workloads/informed-decision', token=token)\n check('parent_list_refused', status == 403)\n status, _ = http('POST', BAO+'auth/kubernetes/login',\n {'role': ROLE, 'jwt': Path('/identity/wrong-audience').read_text()})\n check('wrong_audience_refused', status == 403)\n check('projection_mode', stat.S_IMODE(SECRET.stat().st_mode) == 0o440)\n secret = SECRET.read_text()\n status, result = http('GET', BAO+'platform/data/workloads/informed-decision/sitting-requester', token=token)\n check('exact_path_projection_matches', status == 200 and bool(secret)\n and result.get('data', {}).get('data', {}).get('CLIENT_SECRET') == secret)\n receipt['phase'] = 'requester_exchange'\n class ObservedTransport:\n def request(self, method, url, **kwargs):\n step = 'issuer_token_request' if method == 'POST' else 'issuer_jwks_request'\n receipt['phase'] = step\n status, result = JSONTransport().request(method, url, **kwargs)\n receipt[step+'_ok'] = status == 200\n return status, result\n provider = RequesterTokenProvider(ISSUER, str(SECRET), transport=ObservedTransport())\n check('signed_create_only_exchange', bool(provider()))\n credentials = base64.b64encode((quote_plus(CLIENT_ID)+':'+quote_plus(secret)).encode()).decode()\n for scope in ('approval:approve', 'approval:read', 'approval:consume'):\n status, result = http('POST', ISSUER+'/token', form=True, client_auth=credentials, body=urlencode({\n 'grant_type': 'client_credentials', 'scope': scope}).encode())\n check(scope.replace(':', '_')+'_refused', status in (400, 403) and 'access_token' not in result)\n receipt['complete'] = True\n except BaseException:\n receipt['complete'] = False\n finally:\n if token:\n try:\n status, _ = http('POST', BAO+'auth/token/revoke-self', body={}, token=token)\n receipt['reader_revoked'] = status in (200, 204)\n status, _ = http('GET', BAO+'auth/token/lookup-self', token=token)\n receipt['revoked_lookup_refused'] = status == 403\n if not receipt['reader_revoked'] or not receipt['revoked_lookup_refused']: receipt['complete'] = False\n except BaseException:\n receipt['reader_revoked'] = False\n receipt['complete'] = False\n return receipt\n\nif __name__ == '__main__':\n result = run('--negative' in sys.argv)\n print(json.dumps(result, sort_keys=True))\n sys.exit(0 if result['complete'] else 1)\n" } }, { "apiVersion": "networking.k8s.io/v1", "kind": "NetworkPolicy", "metadata": { "name": "infd-requester-proof", "namespace": "informed-decision" }, "spec": { "podSelector": { "matchLabels": { "verification": "infd-requester-proof" } }, "policyTypes": [ "Ingress", "Egress" ], "ingress": [], "egress": [ { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "kube-system" } } } ], "ports": [ { "protocol": "UDP", "port": 53 }, { "protocol": "TCP", "port": 53 } ] }, { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "openbao" } } } ], "ports": [ { "protocol": "TCP", "port": 8200 } ] }, { "to": [ { "ipBlock": { "cidr": "92.205.62.239/32" } } ], "ports": [ { "protocol": "TCP", "port": 443 } ] }, { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "kube-system" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "traefik" } } } ], "ports": [ { "protocol": "TCP", "port": 8443 } ] } ] } }, { "apiVersion": "v1", "kind": "ConfigMap", "metadata": { "name": "infd-requester-proof", "namespace": "state-hub" }, "data": { "proof.py": "\"\"\"Temporary native proof. Emits only fixed phases and booleans; never raw failures.\"\"\"\nimport base64\nimport json\nimport stat\nimport sys\nfrom pathlib import Path\nfrom urllib.parse import urlencode, quote_plus\nfrom urllib.request import Request, build_opener, ProxyHandler, HTTPRedirectHandler\nfrom urllib.error import HTTPError\nfrom informed_decision.requester import RequesterTokenProvider, CLIENT_ID\nfrom informed_decision.http_transport import JSONTransport\n\nBAO = 'http://openbao.openbao.svc:8200/v1/'\nISSUER = 'https://kc.coulomb.social'\nROLE = 'informed-decision-sitting-requester-eso'\nPOLICY = 'workload-kv-read-informed-decision-sitting-requester-eso'\nSECRET = Path('/var/run/secrets/informed-decision/requester/client-secret')\n\nclass NoRedirect(HTTPRedirectHandler):\n def redirect_request(self, *args, **kwargs): return None\n\ndef http(method, url, body=None, token=None, form=False, client_auth=None):\n headers = {'Content-Type': 'application/x-www-form-urlencoded' if form else 'application/json'}\n if token: headers['X-Vault-Token'] = token\n if client_auth: headers['Authorization'] = 'Basic ' + client_auth\n raw = body if form else (json.dumps(body).encode() if body is not None else None)\n req = Request(url, data=raw, headers=headers, method=method)\n try: response = build_opener(ProxyHandler({}), NoRedirect()).open(req, timeout=5)\n except HTTPError as error: response = error\n with response:\n status = response.code\n content = response.read(262145)\n if len(content) > 262144: raise ValueError()\n return status, json.loads(content) if content else {}\n\ndef run(negative=False):\n receipt = {'complete': False, 'phase': 'start', 'negative_identity': negative}\n token = None\n def check(name, condition):\n receipt['phase'] = name\n receipt[name] = bool(condition)\n if not condition: raise ValueError()\n try:\n receipt['phase'] = 'login'\n status, result = http('POST', BAO+'auth/kubernetes/login',\n {'role': ROLE, 'jwt': Path('/identity/openbao').read_text()})\n if status == 200: token = result.get('auth', {}).get('client_token')\n if negative:\n check('wrong_identity_refused', status == 403 and token is None)\n else:\n auth = result.get('auth', {})\n check('exact_identity', status == 200 and bool(token)\n and auth.get('metadata', {}).get('service_account_name') == 'informed-decision-eso'\n and auth.get('metadata', {}).get('service_account_namespace') == 'informed-decision')\n status, result = http('GET', BAO+'auth/token/lookup-self', token=token)\n data = result.get('data', {})\n check('exact_policy_and_ttl', status == 200 and data.get('policies') == [POLICY]\n and not data.get('identity_policies') and 0 < data.get('ttl', 0) <= 900\n and data.get('creation_ttl') == 900 and data.get('explicit_max_ttl') == 900)\n status, _ = http('GET', BAO+'platform/data/workloads/secrets-engine/approval-requester', token=token)\n check('sibling_get_refused', status == 403)\n status, _ = http('LIST', BAO+'platform/metadata/workloads/informed-decision', token=token)\n check('parent_list_refused', status == 403)\n status, _ = http('POST', BAO+'auth/kubernetes/login',\n {'role': ROLE, 'jwt': Path('/identity/wrong-audience').read_text()})\n check('wrong_audience_refused', status == 403)\n check('projection_mode', stat.S_IMODE(SECRET.stat().st_mode) == 0o440)\n secret = SECRET.read_text()\n status, result = http('GET', BAO+'platform/data/workloads/informed-decision/sitting-requester', token=token)\n check('exact_path_projection_matches', status == 200 and bool(secret)\n and result.get('data', {}).get('data', {}).get('CLIENT_SECRET') == secret)\n receipt['phase'] = 'requester_exchange'\n class ObservedTransport:\n def request(self, method, url, **kwargs):\n step = 'issuer_token_request' if method == 'POST' else 'issuer_jwks_request'\n receipt['phase'] = step\n status, result = JSONTransport().request(method, url, **kwargs)\n receipt[step+'_ok'] = status == 200\n return status, result\n provider = RequesterTokenProvider(ISSUER, str(SECRET), transport=ObservedTransport())\n check('signed_create_only_exchange', bool(provider()))\n credentials = base64.b64encode((quote_plus(CLIENT_ID)+':'+quote_plus(secret)).encode()).decode()\n for scope in ('approval:approve', 'approval:read', 'approval:consume'):\n status, result = http('POST', ISSUER+'/token', form=True, client_auth=credentials, body=urlencode({\n 'grant_type': 'client_credentials', 'scope': scope}).encode())\n check(scope.replace(':', '_')+'_refused', status in (400, 403) and 'access_token' not in result)\n receipt['complete'] = True\n except BaseException:\n receipt['complete'] = False\n finally:\n if token:\n try:\n status, _ = http('POST', BAO+'auth/token/revoke-self', body={}, token=token)\n receipt['reader_revoked'] = status in (200, 204)\n status, _ = http('GET', BAO+'auth/token/lookup-self', token=token)\n receipt['revoked_lookup_refused'] = status == 403\n if not receipt['reader_revoked'] or not receipt['revoked_lookup_refused']: receipt['complete'] = False\n except BaseException:\n receipt['reader_revoked'] = False\n receipt['complete'] = False\n return receipt\n\nif __name__ == '__main__':\n result = run('--negative' in sys.argv)\n print(json.dumps(result, sort_keys=True))\n sys.exit(0 if result['complete'] else 1)\n" } }, { "apiVersion": "networking.k8s.io/v1", "kind": "NetworkPolicy", "metadata": { "name": "infd-requester-proof", "namespace": "state-hub" }, "spec": { "podSelector": { "matchLabels": { "verification": "infd-requester-proof" } }, "policyTypes": [ "Ingress", "Egress" ], "ingress": [], "egress": [ { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "kube-system" } } } ], "ports": [ { "protocol": "UDP", "port": 53 }, { "protocol": "TCP", "port": 53 } ] }, { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "openbao" } } } ], "ports": [ { "protocol": "TCP", "port": 8200 } ] }, { "to": [ { "ipBlock": { "cidr": "92.205.62.239/32" } } ], "ports": [ { "protocol": "TCP", "port": 443 } ] }, { "to": [ { "namespaceSelector": { "matchLabels": { "kubernetes.io/metadata.name": "kube-system" } }, "podSelector": { "matchLabels": { "app.kubernetes.io/name": "traefik" } } } ], "ports": [ { "protocol": "TCP", "port": 8443 } ] } ] } }, { "apiVersion": "v1", "kind": "ServiceAccount", "metadata": { "name": "informed-decision-eso", "namespace": "state-hub", "labels": { "verification": "infd-requester-proof" } }, "automountServiceAccountToken": false }, { "apiVersion": "batch/v1", "kind": "Job", "metadata": { "name": "infd-requester-proof", "namespace": "informed-decision" }, "spec": { "backoffLimit": 0, "activeDeadlineSeconds": 90, "ttlSecondsAfterFinished": 600, "template": { "metadata": { "labels": { "verification": "infd-requester-proof" } }, "spec": { "serviceAccountName": "informed-decision-eso", "automountServiceAccountToken": false, "restartPolicy": "Never", "securityContext": { "runAsNonRoot": true, "runAsUser": 10001, "runAsGroup": 10001, "fsGroup": 10001, "seccompProfile": { "type": "RuntimeDefault" } }, "containers": [ { "name": "proof", "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", "command": [ "python", "/proof/proof.py" ], "resources": { "requests": { "cpu": "5m", "memory": "32Mi" }, "limits": { "cpu": "100m", "memory": "128Mi" } }, "securityContext": { "readOnlyRootFilesystem": true, "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] } }, "volumeMounts": [ { "name": "proof", "mountPath": "/proof", "readOnly": true }, { "name": "identity", "mountPath": "/identity", "readOnly": true }, { "name": "requester", "mountPath": "/var/run/secrets/informed-decision/requester", "readOnly": true } ] } ], "volumes": [ { "name": "proof", "configMap": { "name": "infd-requester-proof" } }, { "name": "identity", "projected": { "defaultMode": 288, "sources": [ { "serviceAccountToken": { "path": "openbao", "audience": "openbao", "expirationSeconds": 600 } }, { "serviceAccountToken": { "path": "wrong-audience", "audience": "informed-decision-verification-wrong-audience", "expirationSeconds": 600 } } ] } }, { "name": "requester", "secret": { "secretName": "informed-decision-sitting-requester", "defaultMode": 288, "items": [ { "key": "client-secret", "path": "client-secret" } ] } } ] } } } }, { "apiVersion": "batch/v1", "kind": "Job", "metadata": { "name": "infd-requester-proof-wrong-sa", "namespace": "informed-decision" }, "spec": { "backoffLimit": 0, "activeDeadlineSeconds": 90, "ttlSecondsAfterFinished": 600, "template": { "metadata": { "labels": { "verification": "infd-requester-proof" } }, "spec": { "serviceAccountName": "review", "automountServiceAccountToken": false, "restartPolicy": "Never", "securityContext": { "runAsNonRoot": true, "runAsUser": 10001, "runAsGroup": 10001, "fsGroup": 10001, "seccompProfile": { "type": "RuntimeDefault" } }, "containers": [ { "name": "proof", "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", "command": [ "python", "/proof/proof.py", "--negative" ], "resources": { "requests": { "cpu": "5m", "memory": "32Mi" }, "limits": { "cpu": "100m", "memory": "128Mi" } }, "securityContext": { "readOnlyRootFilesystem": true, "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] } }, "volumeMounts": [ { "name": "proof", "mountPath": "/proof", "readOnly": true }, { "name": "identity", "mountPath": "/identity", "readOnly": true } ] } ], "volumes": [ { "name": "proof", "configMap": { "name": "infd-requester-proof" } }, { "name": "identity", "projected": { "defaultMode": 288, "sources": [ { "serviceAccountToken": { "path": "openbao", "audience": "openbao", "expirationSeconds": 600 } }, { "serviceAccountToken": { "path": "wrong-audience", "audience": "informed-decision-verification-wrong-audience", "expirationSeconds": 600 } } ] } } ] } } } }, { "apiVersion": "batch/v1", "kind": "Job", "metadata": { "name": "infd-requester-proof-wrong-ns", "namespace": "state-hub" }, "spec": { "backoffLimit": 0, "activeDeadlineSeconds": 90, "ttlSecondsAfterFinished": 600, "template": { "metadata": { "labels": { "verification": "infd-requester-proof" } }, "spec": { "serviceAccountName": "informed-decision-eso", "automountServiceAccountToken": false, "restartPolicy": "Never", "securityContext": { "runAsNonRoot": true, "runAsUser": 10001, "runAsGroup": 10001, "fsGroup": 10001, "seccompProfile": { "type": "RuntimeDefault" } }, "containers": [ { "name": "proof", "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:804d89fb0bb3d691720380eedde4f361133bada717d1773c2eb349004346ebf1", "command": [ "python", "/proof/proof.py", "--negative" ], "resources": { "requests": { "cpu": "5m", "memory": "32Mi" }, "limits": { "cpu": "100m", "memory": "128Mi" } }, "securityContext": { "readOnlyRootFilesystem": true, "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] } }, "volumeMounts": [ { "name": "proof", "mountPath": "/proof", "readOnly": true }, { "name": "identity", "mountPath": "/identity", "readOnly": true } ] } ], "volumes": [ { "name": "proof", "configMap": { "name": "infd-requester-proof" } }, { "name": "identity", "projected": { "defaultMode": 288, "sources": [ { "serviceAccountToken": { "path": "openbao", "audience": "openbao", "expirationSeconds": 600 } }, { "serviceAccountToken": { "path": "wrong-audience", "audience": "informed-decision-verification-wrong-audience", "expirationSeconds": 600 } } ] } } ] } } } } ] }