92a0f5ed59
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
60 lines
2.8 KiB
Python
60 lines
2.8 KiB
Python
#!/usr/bin/env python3
|
|
"""Silent attended Grafana API probe through a fixed localhost tunnel."""
|
|
import argparse
|
|
import base64
|
|
import json
|
|
import os
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
from state_hub_preflight_lane import LaneError, bao, data
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument('--receipt', required=True)
|
|
args = parser.parse_args()
|
|
fd = os.open(args.receipt, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
|
|
receipt = {'schema': 'rapp-telemetry.access.v1', 'status': 'failed'}
|
|
try:
|
|
policies = data(bao(['token', 'lookup', '-format=json']))['data']['policies']
|
|
if 'platform-admin' not in policies or 'root' in policies:
|
|
raise LaneError('attended_platform_admin_required')
|
|
opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
|
|
def request(path, headers=None):
|
|
req = urllib.request.Request('http://127.0.0.1:13001' + path, headers=headers or {})
|
|
try:
|
|
with opener.open(req, timeout=10) as response:
|
|
return response.status, json.load(response)
|
|
except urllib.error.HTTPError as error:
|
|
return error.code, None
|
|
for label, headers in [('anonymous_denied', {}), ('forged_proxy_denied', {
|
|
'X-WEBAUTH-USER': 'admin', 'Remote-User': 'admin', 'Remote-Groups': 'admins'})]:
|
|
if request('/api/user', headers)[0] != 401:
|
|
raise LaneError('negative_access_failed')
|
|
receipt[label] = True
|
|
native = data(bao(['read', '-format=json', 'platform/data/workloads/telemetry/grafana-admin']))['data']['data']
|
|
credential = base64.b64encode((native['ADMIN_USERNAME'] + ':' + native['ADMIN_PASSWORD']).encode()).decode()
|
|
headers = {'Authorization': 'Basic ' + credential}
|
|
status, user = request('/api/user', headers)
|
|
if status != 200 or user.get('login') != 'admin' or not user.get('isGrafanaAdmin'):
|
|
raise LaneError('positive_access_failed')
|
|
receipt['native_admin_authenticated'] = True
|
|
status, sources = request('/api/datasources', headers)
|
|
if status != 200 or not any(s['type'] == 'prometheus' for s in sources):
|
|
raise LaneError('datasource_missing')
|
|
receipt['prometheus_datasource_present'] = True
|
|
status, dashboards = request('/api/search?type=dash-db', headers)
|
|
if status != 200 or not dashboards:
|
|
raise LaneError('dashboards_missing')
|
|
receipt.update(status='verified', dashboard_count=len(dashboards))
|
|
except Exception:
|
|
receipt['error'] = 'access_verification_failed'
|
|
finally:
|
|
with os.fdopen(fd, 'w') as output:
|
|
json.dump(receipt, output, indent=2)
|
|
return 0 if receipt['status'] == 'verified' else 1
|
|
|
|
|
|
if __name__ == '__main__':
|
|
raise SystemExit(main())
|