2e2c31d237
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
74 lines
3.8 KiB
Python
74 lines
3.8 KiB
Python
"""Dedicated Kubernetes renewal worker. Only sanitized outcome metadata is emitted."""
|
|
import base64,json,sys,time,urllib.request,urllib.error,urllib.parse
|
|
from pathlib import Path
|
|
BAO="http://openbao.openbao.svc.cluster.local:8200/v1"
|
|
PI="http://privacyidea.mfa.svc.cluster.local:8080"
|
|
ISSUER="platform/data/workloads/net-kingdom/keycape-factor-issuer"
|
|
TARGET="platform/data/workloads/net-kingdom/keycape-factor-read"
|
|
USER="keycape-factor-reader"
|
|
PROVENANCE="RPF-WP-0040"
|
|
class Failure(Exception):pass
|
|
class NoRedirect(urllib.request.HTTPRedirectHandler):
|
|
def redirect_request(self,*args,**kwargs):return None
|
|
|
|
def http(url,body=None,headers=None,method=None,form=False):
|
|
data=None
|
|
headers=dict(headers or {})
|
|
if body is not None:
|
|
data=(urllib.parse.urlencode(body) if form else json.dumps(body)).encode()
|
|
headers["Content-Type"]="application/x-www-form-urlencoded" if form else "application/json"
|
|
req=urllib.request.Request(url,data=data,headers=headers,method=method)
|
|
try:
|
|
with urllib.request.build_opener(NoRedirect()).open(req,timeout=15) as r:
|
|
raw=r.read(1048577)
|
|
if len(raw)>1048576:raise Failure()
|
|
return r.status,json.loads(raw) if raw else {}
|
|
except urllib.error.HTTPError as e:return e.code,{}
|
|
|
|
def success(code,data):
|
|
if code!=200 or not data.get("result",{}).get("status"):raise Failure()
|
|
return data["result"]["value"]
|
|
|
|
def run():
|
|
session=None;receipt={"success":False,"phase":"workload_login"}
|
|
try:
|
|
jwt=Path("/var/run/keycape-factor/token").read_text().strip()
|
|
code,body=http(BAO+"/auth/kubernetes/login",{"role":"keycape-factor-renewer","jwt":jwt})
|
|
if code!=200:raise Failure()
|
|
session=body["auth"]["client_token"];headers={"X-Vault-Token":session}
|
|
receipt["phase"]="issuer_custody"
|
|
code,body=http(BAO+"/"+ISSUER,headers=headers)
|
|
if code!=200:raise Failure()
|
|
issuer=body["data"]["data"]
|
|
if issuer.get("REQUEST")!=PROVENANCE or issuer.get("USERNAME")!=USER:raise Failure()
|
|
receipt["phase"]="provider_authentication"
|
|
value=success(*http(PI+"/auth",{"username":USER,"password":issuer["PASSWORD"]},form=True))
|
|
if value.get("role")!="admin" or value.get("username")!=USER:raise Failure()
|
|
token=value["token"];claims=json.loads(base64.urlsafe_b64decode(token.split('.')[1]+'==='));expiry=int(claims["exp"])
|
|
if not 300<expiry-time.time()<=7200:raise Failure()
|
|
receipt["phase"]="provider_scope"
|
|
provider_headers={"Authorization":token}
|
|
listing=success(*http(PI+"/token/?tokenrealm=coulomb&active=True&pagesize=1",headers=provider_headers))
|
|
if not isinstance(listing.get("tokens"),list) or not isinstance(listing.get("count"),int):raise Failure()
|
|
code,_=http(PI+"/policy/",headers=provider_headers)
|
|
if code not in (401,403):raise Failure()
|
|
receipt["phase"]="publish"
|
|
code,body=http(BAO+"/"+TARGET,headers=headers)
|
|
if code!=200 or body["data"]["data"].get("REQUEST")!=PROVENANCE:raise Failure()
|
|
version=body["data"]["metadata"]["version"]
|
|
code,_=http(BAO+"/"+TARGET,{"options":{"cas":version},"data":{"TOKEN":token,"EXPIRES_AT":expiry,"REQUEST":PROVENANCE}},headers=headers)
|
|
if code!=200:raise Failure()
|
|
code,body=http(BAO+"/"+TARGET,headers=headers)
|
|
if code!=200 or body["data"]["data"]["TOKEN"]!=token:raise Failure()
|
|
receipt.update(success=True,phase="complete",expires_at=expiry,kv_version=body["data"]["metadata"]["version"],cross_user_factor_visible=listing["count"]>0)
|
|
except Exception:pass
|
|
finally:
|
|
if session:
|
|
try:
|
|
code,_=http(BAO+"/auth/token/revoke-self",headers={"X-Vault-Token":session},method="POST")
|
|
receipt["session_revoked"]=code in (200,204)
|
|
except Exception:receipt["session_revoked"]=False
|
|
if not receipt["session_revoked"]:receipt["success"]=False;receipt["phase"]="session_cleanup"
|
|
return receipt
|
|
if __name__=="__main__":
|
|
receipt=run();print(json.dumps(receipt));raise SystemExit(0 if receipt["success"] else 1)
|