wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into codex/sre-typed-automation-20260715

Browse Source 
# Conflicts:
#	apps/api/src/services/iwooos_wazuh_controlled_executor_runtime.py
This commit is contained in:
ogt
2026-07-15 17:45:18 +08:00
parent 1e84f7cb21 72da320ab8
commit 39a8abefe0
6 changed files with 150 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
apps/api/src/services/iwooos_wazuh_controlled_executor_runtime.py
View File

@@ -31,6 +31,12 @@ POSTURE_PROPOSAL_SOURCE = "iwooos_wazuh_manager_posture_scheduler"
INGRESS_PROPOSAL_SOURCE = "iwooos_wazuh_alert_ingress_scheduler"
POSTURE_RUN_NAMESPACE = "awoooi:iwooos:wazuh-manager-posture"
INGRESS_RUN_NAMESPACE = "awoooi:iwooos:wazuh-alert-ingress"
_PRIVILEGED_CONVERGENCE_CAPABILITY_MISSING = (
"wazuh_privileged_convergence_capability_missing"
)
_PUBLIC_SAFE_CHECK_FAILURE_MARKERS = frozenset(
{_PRIVILEGED_CONVERGENCE_CAPABILITY_MISSING}
)
_LIVE_RUNTIME_SQL = """
WITH latest_candidate AS (
@@ -82,6 +88,18 @@ _LIVE_RUNTIME_SQL = """
check_mode.output ->> 'timed_out',
check_mode.dry_run_result ->> 'timed_out'
) AS check_timed_out,
CASE
WHEN concat_ws(
' ',
check_mode.error,
check_mode.output ->> 'stdout_tail',
check_mode.output ->> 'stderr_tail',
check_mode.dry_run_result ->> 'stdout_tail',
check_mode.dry_run_result ->> 'stderr_tail'
) LIKE '%wazuh_privileged_convergence_capability_missing%'
THEN 'wazuh_privileged_convergence_capability_missing'
ELSE NULL
END AS check_failure_marker,
check_mode.duration_ms AS check_duration_ms,
check_mode.created_at AS check_created_at
FROM automation_operation_log check_mode
@@ -662,6 +680,14 @@ def _next_action(
else "internal_worker_enqueue_wazuh_manager_posture_candidate"
)
if check_failed:
if (
check_failure_class
== _PRIVILEGED_CONVERGENCE_CAPABILITY_MISSING
):
return (
"queue_critical_break_glass_privileged_convergence_capability_"
"then_bounded_retry"
)
return (
"repair_and_enqueue_bounded_retry:"
+ (check_failure_class or "ansible_check_mode_failed")
@@ -684,6 +710,9 @@ def _next_action(
def _check_failure_class(data: Mapping[str, Any]) -> str | None:
if data.get("check_status") != "failed":
return None
failure_marker = str(data.get("check_failure_marker") or "").strip()
if failure_marker in _PUBLIC_SAFE_CHECK_FAILURE_MARKERS:
return failure_marker
if str(data.get("check_timed_out") or "").lower() == "true":
return "ansible_check_mode_timeout"
returncode = str(data.get("check_returncode") or "").strip()