coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

CUST-WP-0073: railiance01 cutover steps 2-4 evidence; fix step-9 verifier identity and subresource probes
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 22s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-10-20 22:42:19 +02:00
parent 403222f8c6
commit be1b9aa680
3 changed files with 30 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/changes/CUST-WP-0073/credential-boundary-r1/SHA256SUMS
View file

@ -6,4 +6,4 @@ aa99050e3c446faf773a60701e5d1215f90ebca66a20edcb95975611e8683a5f original-revis
c3815aea14fe0b1ba6e8b5e4b339a82496adb511a2ea587d38c797c9513e86f4 source-pins.json
3077831ba2efdfe53ec643c4a925801850edeecf9f1f52a43d12c3ae923da4e5 test_negative_verifier.py
88da0faf33b532acbec16e5f28acfb87278ec66328effb97ff9404891a818b65 validation.json
7f8cfb9340873acf508072f19e8476603a61a329041e381f0464000f2e5d795f verify_agent_denials.py
d3ab986707bc5f7f26bed15189734a13735c44e0f0c56c9e1fda13d61d3bed9f verify_agent_denials.py

15
docs/changes/CUST-WP-0073/credential-boundary-r1/verify_agent_denials.py
View file

@ -9,12 +9,15 @@ import os
import pwd
import subprocess
IDENTITY = 'system:serviceaccount:custodian-agents:custodian-codex'
IDENTITY = 'system:serviceaccount:custodian-agents:custodian-agent'
# Subresources must use --subresource: `can-i get pods/log` asks about a pod
# named "log", which the curated read role (get pods) answers yes.
DENIALS = [
('get', 'secrets'), ('list', 'secrets'), ('watch', 'secrets'),
('get', 'configmaps'), ('get', 'pods'), ('get', 'pods/log'),
('create', 'pods/exec'), ('create', 'pods/attach'), ('create', 'pods'),
('patch', 'deployments.apps'), ('create', 'serviceaccounts/token'),
('get', 'configmaps'), ('get', 'pods --subresource=log'),
('create', 'pods --subresource=exec'), ('create', 'pods --subresource=attach'),
('create', 'pods --subresource=portforward'), ('create', 'pods'),
('patch', 'deployments.apps'), ('create', 'serviceaccounts --subresource=token'),
('patch', 'applications.argoproj.io'),
]
@ -63,13 +66,13 @@ def probe(kubectl, context, account, inventory):
return {'status': 'refused_wrong_identity', 'passed': False}
checks = {}
for verb, resource in DENIALS:
code, output = run(base + ['can-i', verb, resource, '--all-namespaces'])
code, output = run(base + ['can-i', verb, *resource.split(), '--all-namespaces'])
checks[f'all-namespaces:{verb}:{resource}'] = code == 1 and output.strip() == b'no'
# An all-namespaces denial can coexist with a namespaced RoleBinding grant.
# Probe each namespace supplied in the separately supervised complete inventory.
for namespace in inventory['namespaces']:
for verb, resource in DENIALS:
code, output = run(base + ['can-i', verb, resource, '--namespace', namespace])
code, output = run(base + ['can-i', verb, *resource.split(), '--namespace', namespace])
checks[f'{namespace}:{verb}:{resource}'] = code == 1 and output.strip() == b'no'
for verb, resource in CLUSTER_DENIALS:
code, output = run(base + ['can-i', verb, resource])