coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: admit existing OpenBao catalog lanes
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source
This commit is contained in:
tegwick 2026-08-21 08:20:33 +02:00
parent 9d383442c8
commit 784be978bf
29 changed files with 1490 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

56
src/secrets_engine/apply.py
View file

@ -37,38 +37,56 @@ def apply_plan(client: OpenBaoClient, entry: CatalogEntry, plan: Plan, ttl: str
# 1. KV mount. Auth-capability lanes grant operational access on an existing
# mount (for example ssh/sign/<role>) and never create or store KV values.
if entry.stores_kv_value():
if entry.manages_mount:
if client.kv_mount_exists(entry.mount):
skipped.append(f"kv-mount {entry.mount} (already present)")
else:
client.ensure_kv_mount(entry.mount)
applied.append(f"kv-mount {entry.mount}")
elif entry.stores_kv_value():
skipped.append(f"kv-mount {entry.mount} (externally managed; no mutation)")
else:
skipped.append(f"kv-mount {entry.mount} (not applicable for {entry.kind})")
# 2. Consumer ACL policy (write only if changed).
current = client.read_policy(plan.policy_name)
if current and _normalize(current) == _normalize(plan.policy_hcl):
skipped.append(f"policy {plan.policy_name} (unchanged)")
if entry.manages_delivery_auth:
current = client.read_policy(plan.policy_name)
if current and _normalize(current) == _normalize(plan.policy_hcl):
skipped.append(f"policy {plan.policy_name} (unchanged)")
else:
client.write_policy(plan.policy_name, plan.policy_hcl)
applied.append(f"policy {plan.policy_name}")
else:
client.write_policy(plan.policy_name, plan.policy_hcl)
applied.append(f"policy {plan.policy_name}")
skipped.append(f"policy {plan.policy_name} (externally managed; no mutation)")
# 3. Consumer approle bound to that policy.
client.ensure_approle_enabled()
if entry.kind == "auth-capability":
client.write_approle(
plan.role_name,
[plan.policy_name],
ttl=entry.token_ttl,
max_ttl=entry.token_max_ttl,
secret_id_ttl=entry.secret_id_ttl,
secret_id_num_uses=entry.secret_id_num_uses,
token_num_uses=entry.token_num_uses,
)
if entry.manages_delivery_auth:
client.ensure_approle_enabled()
if entry.kind == "auth-capability":
client.write_approle(
plan.role_name,
[plan.policy_name],
ttl=entry.token_ttl,
max_ttl=entry.token_max_ttl,
secret_id_ttl=entry.secret_id_ttl,
secret_id_num_uses=entry.secret_id_num_uses,
token_num_uses=entry.token_num_uses,
)
else:
client.write_approle(
plan.role_name,
[plan.policy_name],
ttl=entry.delivery_token_ttl or ttl,
max_ttl=entry.delivery_token_max_ttl,
secret_id_ttl=entry.delivery_secret_id_ttl,
secret_id_num_uses=entry.delivery_secret_id_num_uses,
token_num_uses=entry.delivery_token_num_uses,
)
applied.append(f"approle {plan.role_name} -> [{plan.policy_name}]")
elif entry.has_delivery_auth:
skipped.append(f"approle {plan.role_name} (externally managed; no mutation)")
else:
client.write_approle(plan.role_name, [plan.policy_name], ttl=ttl)
applied.append(f"approle {plan.role_name} -> [{plan.policy_name}]")
skipped.append("approle (no native delivery auth declared)")
return ApplyResult(applied=applied, skipped=skipped)