6b1c1c700d
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
21 lines
2.1 KiB
Python
21 lines
2.1 KiB
Python
import subprocess,json,datetime
|
|
remote=r'''
|
|
import json,subprocess,datetime
|
|
out={'observed_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'secret_objects_read':False,'raw_output_suppressed':True,'workloads':[],'delivery':[]}
|
|
for resource in ['deployments','statefulsets']:
|
|
r=subprocess.run(['kubectl','get',resource,'-n','forgejo','-o','json'],capture_output=True,text=True)
|
|
if r.returncode:out[resource+'_read']=False;continue
|
|
out[resource+'_read']=True
|
|
for d in json.loads(r.stdout)['items']:
|
|
s=d['spec']['template']['spec'];out['workloads'].append({'kind':d['kind'],'name':d['metadata']['name'],'uid':d['metadata']['uid'],'resourceVersion':d['metadata']['resourceVersion'],'generation':d['metadata'].get('generation'),'readyReplicas':d.get('status',{}).get('readyReplicas',0),'serviceAccountName':s.get('serviceAccountName','default'),'automountServiceAccountToken':s.get('automountServiceAccountToken'),'containers':[{'name':c['name'],'image':c['image'],'env_names':[e['name'] for e in c.get('env',[])],'env_secret_refs':[{'env':e['name'],'secret_name':e['valueFrom']['secretKeyRef']['name'],'key':e['valueFrom']['secretKeyRef']['key']} for e in c.get('env',[]) if 'secretKeyRef' in e.get('valueFrom',{})]} for c in s['containers']]})
|
|
r=subprocess.run(['kubectl','get','externalsecrets','-n','forgejo','-o','json'],capture_output=True,text=True)
|
|
out['externalsecrets_read']=r.returncode==0
|
|
if not r.returncode:
|
|
for d in json.loads(r.stdout)['items']:
|
|
out['delivery'].append({'name':d['metadata']['name'],'uid':d['metadata']['uid'],'store':d['spec'].get('secretStoreRef'),'target_name':d['spec'].get('target',{}).get('name'),'ready':any(c['type']=='Ready' and c['status']=='True' for c in d.get('status',{}).get('conditions',[])),'remote_paths':[x.get('remoteRef',{}).get('key') for x in d['spec'].get('data',[])]})
|
|
print(json.dumps(out))
|
|
'''
|
|
r=subprocess.run(['ssh','railiance01','python3 -'],input=remote,capture_output=True,text=True)
|
|
try:out=json.loads(r.stdout)
|
|
except Exception:out={'native_metadata_read':False,'raw_output_suppressed':True}
|
|
open('/tmp/security-case-forgejo-native-metadata.json','w').write(json.dumps(out,indent=2)+'\n');print(json.dumps(out))
|