8c44256699
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 292700@bnt-lap001 Assistant-Session: 42de6b79-9019-4cfd-b49a-6db3bbfe9341
47 lines
1.9 KiB
Bash
Executable file
47 lines
1.9 KiB
Bash
Executable file
#!/bin/sh
|
|
# RPF-IN-0002: write policy + Kubernetes-auth role for tenant-engine's audit-core
|
|
# sender ESO lane. Attended, silent, idempotent. Run from a checkout at the
|
|
# reviewed commit:
|
|
# BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
|
|
# warden access openbao-platform-admin-login --exec -- \
|
|
# sh scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh
|
|
# Prints nothing (warden fails closed on child output). Exit codes:
|
|
# 0 ok / already present and identical; 3 existing object differs;
|
|
# 4 write failed; 5 verify failed. Does not read or write any KV value.
|
|
exec >/dev/null 2>&1
|
|
set -u
|
|
P=workload-kv-read-tenant-engine-audit-core-sender-eso
|
|
R=tenant-engine-audit-core-sender-eso
|
|
F="$(dirname "$0")/../openbao/policies/$P.hcl"
|
|
|
|
cur=$(bao policy read "$P" 2>/dev/null) || cur=""
|
|
if [ -n "$cur" ]; then
|
|
[ "$cur" = "$(cat "$F")" ] || exit 3
|
|
else
|
|
bao policy write "$P" "$F" || exit 4
|
|
fi
|
|
|
|
if bao read -format=json "auth/kubernetes/role/$R" >/tmp/.te-role.$$ 2>/dev/null; then
|
|
python3 - /tmp/.te-role.$$ "$P" <<'PY' || { rm -f /tmp/.te-role.$$; exit 3; }
|
|
import json,sys
|
|
d=json.load(open(sys.argv[1]))['data']
|
|
ok=(d.get('bound_service_account_names')==['tenant-engine-eso']
|
|
and d.get('bound_service_account_namespaces')==['tenant-engine']
|
|
and d.get('audience')=='openbao' and d.get('token_policies')==[sys.argv[2]]
|
|
and d.get('token_ttl')==900 and d.get('token_max_ttl')==900
|
|
and d.get('token_explicit_max_ttl')==900 and d.get('token_no_default_policy') is True)
|
|
sys.exit(0 if ok else 1)
|
|
PY
|
|
else
|
|
bao write "auth/kubernetes/role/$R" \
|
|
bound_service_account_names=tenant-engine-eso \
|
|
bound_service_account_namespaces=tenant-engine \
|
|
audience=openbao token_policies="$P" \
|
|
token_ttl=15m token_max_ttl=15m token_explicit_max_ttl=15m \
|
|
token_no_default_policy=true || exit 4
|
|
fi
|
|
rm -f /tmp/.te-role.$$
|
|
|
|
[ "$(bao policy read "$P")" = "$(cat "$F")" ] || exit 5
|
|
bao read "auth/kubernetes/role/$R" || exit 5
|
|
exit 0
|