Maidn/maidn-cli
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix: use valid E2E probe secret path

Browse source
This commit is contained in:
eding 2026-09-13 11:49:41 +02:00
parent 1bca082c77
commit 217f03d4be
3 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docs/secrets.md
View file

@ -25,7 +25,7 @@ The webhook-only path requires a complete delivery contract, an approved configu
## Automated app-secret identities ## Automated app-secret identities
Use `bootstrap --provision-app-secret-identities --e2e-app <app>` to create a Use `bootstrap --provision-app-secret-identities --e2e-app <app>` to create a
short-lived non-root `admin` identity and an exact-path E2E probe identity. short-lived non-root `admin` identity and an exact-path `e2e-probe` identity.
Bootstrap reads root recovery material only through its encrypted recovery Bootstrap reads root recovery material only through its encrypted recovery
bundle, writes the generated tokens only into encrypted operational state, and bundle, writes the generated tokens only into encrypted operational state, and
never prints either value. `app secret --identity admin` and never prints either value. `app secret --identity admin` and

4
internal/openbao/bootstrap.go
View file

@ -441,9 +441,9 @@ path "secret/data/shared/*" { capabilities = ["create", "update"] }
path "secret/metadata/shared/*" { capabilities = ["list", "read", "delete"] } path "secret/metadata/shared/*" { capabilities = ["list", "read", "delete"] }
EOF EOF
cat >/tmp/maidn-e2e.hcl <<'EOF' cat >/tmp/maidn-e2e.hcl <<'EOF'
path "secret/data/apps/` + app + `/E2E_PROBE" { capabilities = ["create", "update"] } path "secret/data/apps/` + app + `/e2e-probe" { capabilities = ["create", "update"] }
path "secret/metadata/apps/` + app + `" { capabilities = ["list"] } path "secret/metadata/apps/` + app + `" { capabilities = ["list"] }
path "secret/metadata/apps/` + app + `/E2E_PROBE" { capabilities = ["read", "delete"] } path "secret/metadata/apps/` + app + `/e2e-probe" { capabilities = ["read", "delete"] }
EOF EOF
bao policy write maidn-app-secret-admin /tmp/maidn-app-secret-admin.hcl >/dev/null bao policy write maidn-app-secret-admin /tmp/maidn-app-secret-admin.hcl >/dev/null
bao policy write maidn-e2e-` + app + ` /tmp/maidn-e2e.hcl >/dev/null bao policy write maidn-e2e-` + app + ` /tmp/maidn-e2e.hcl >/dev/null

2
internal/openbao/bootstrap_test.go
View file

@ -191,7 +191,7 @@ func TestProvisionAppSecretIdentitiesScopesFixtureWithoutRootLeak(t *testing.T)
} }
execInPodMutation = func(_ string, input []byte, args ...string) ([]byte, error) { execInPodMutation = func(_ string, input []byte, args ...string) ([]byte, error) {
command := strings.Join(args, " ") command := strings.Join(args, " ")
if string(input) != "root-token\n" || !strings.Contains(command, `secret/data/apps/maidn-e2e-web/E2E_PROBE`) || strings.Contains(command, `secret/data/apps/maidn-e2e-web/*`) { if string(input) != "root-token\n" || !strings.Contains(command, `secret/data/apps/maidn-e2e-web/e2e-probe`) || strings.Contains(command, `secret/data/apps/maidn-e2e-web/*`) {
t.Fatal("fixture identity policy scope is incorrect") t.Fatal("fixture identity policy scope is incorrect")
} }
return []byte("eyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImFkbWluLXRva2VuIn19\neyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImUyZS10b2tlbiJ9fQ==\n"), nil return []byte("eyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImFkbWluLXRva2VuIn19\neyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImUyZS10b2tlbiJ9fQ==\n"), nil