wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(iwooos): close Wazuh capability retry gate
Some checks failed
CD Pipeline / select-latest-carrier (push) Successful in 52s
Details
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 3m0s
Details
CD Pipeline / revalidate-deploy-carrier (push) Successful in 35s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / revalidate-post-deploy-carrier (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-07-22 15:25:58 +08:00
parent 8fe8bc4b85
commit 602ba003cf
13 changed files with 4512 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

289
apps/api/src/jobs/awooop_ansible_candidate_backfill_job.py
View File

@@ -31,6 +31,7 @@ from src.services.awooop_ansible_audit_service import (
verified_ansible_candidate_terminal_sql,
)
from src.services.awooop_ansible_check_mode_service import (
WAZUH_CONTROLLED_CAPABILITY_MAX_RETRIES,
preflight_failed_apply_retry_queue_once,
)
from src.services.evidence_snapshot import EvidenceSnapshot
@@ -79,6 +80,12 @@ _WAZUH_CONTROLLED_CAPABILITY_PACKET_OPERATION_TYPE = (
_WAZUH_PRIVILEGED_CONVERGENCE_SECRET_REFERENCE_MISSING = (
"wazuh_privileged_convergence_secret_reference_missing"
)
_WAZUH_PRIVILEGED_CONVERGENCE_CAPABILITY_MISSING = (
"wazuh_privileged_convergence_capability_missing"
)
_WAZUH_CRITICAL_BREAK_GLASS_RECEIPTS_MISSING = (
"critical_secret_reference_owner_approval_and_broker_receipts_missing"
)
_EXECUTION_CAPABILITY_FALLBACK_OPERATION_TYPE = "remediation_executed"
_WAZUH_SOURCE_RECURRENCE_DRIFT_WORK_ITEM_ID = (
"DRIFT-WAZUH-SOURCE-RECURRENCE"
@@ -1178,7 +1185,24 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
candidate.status AS candidate_status,
candidate.input ->> 'automation_run_id' AS automation_run_id,
candidate.input ->> 'source_receipt_ref' AS source_receipt_ref,
candidate.input ->> 'incident_id' AS incident_id,
check_mode.status AS latest_check_status,
check_mode.input ->> 'capability_retry_generation'
AS latest_check_capability_retry_generation,
check_mode.input ->> 'controlled_apply_blocker'
AS latest_check_controlled_apply_blocker,
check_mode.input ->> 'break_glass_approval_id'
AS latest_check_break_glass_approval_id,
coalesce(
(
check_mode.input
->> 'break_glass_apply_authorized'
)::boolean,
false
) AS latest_check_break_glass_apply_authorized,
check_mode.input
->> 'break_glass_apply_terminal_status'
AS latest_check_break_glass_apply_terminal_status,
apply.status AS latest_apply_status,
learning.status AS latest_learning_status,
capability_packet.status
@@ -1187,6 +1211,8 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
AS latest_controlled_capability_queue_status,
capability_packet.output ->> 'failure_class'
AS latest_controlled_capability_failure_class,
capability_packet.input ->> 'capability_retry_generation'
AS latest_controlled_capability_retry_generation,
capability_packet.input
#>> '{gate_lifecycle,expires_at}'
AS latest_controlled_capability_packet_expires_at,
@@ -1217,7 +1243,10 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
) AS predecision_evidence_ready
FROM automation_operation_log candidate
LEFT JOIN LATERAL (
SELECT check_receipt.op_id, check_receipt.status
SELECT
check_receipt.op_id,
check_receipt.status,
check_receipt.input
FROM automation_operation_log check_receipt
WHERE check_receipt.parent_op_id = candidate.op_id
AND check_receipt.operation_type = 'ansible_check_mode_executed'
@@ -1243,7 +1272,11 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
LEFT JOIN LATERAL (
SELECT packet.status, packet.input, packet.output
FROM automation_operation_log packet
WHERE packet.parent_op_id = check_mode.op_id
JOIN automation_operation_log packet_owner_check
ON packet.parent_op_id = packet_owner_check.op_id
WHERE packet_owner_check.parent_op_id = candidate.op_id
AND packet_owner_check.operation_type =
'ansible_check_mode_executed'
AND (
packet.operation_type =
:capability_packet_operation_type
@@ -1290,7 +1323,53 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
AND candidate.input #>> '{source_recurrence,occurrence_id}' = :source_occurrence_id
)
)
AND candidate.created_at >= NOW() - (:freshness_hours * INTERVAL '1 hour')
AND (
candidate.created_at >= NOW() - (
:freshness_hours * INTERVAL '1 hour'
)
OR (
:retain_controlled_capability_owner
AND (
(
capability_packet.status = 'pending'
AND capability_packet.output
->> 'queue_status'
IN ('queued', 'retry_exhausted')
)
OR (
check_mode.input
->> 'capability_retry_generation'
~ '^[1-9][0-9]*$'
AND (
check_mode.status = 'pending'
OR check_mode.input
->> 'controlled_apply_blocker'
IS NOT NULL
OR apply.status = 'pending'
OR (
coalesce(
(
check_mode.input
->> 'break_glass_apply_authorized'
)::boolean,
false
)
AND (
apply.status IS NULL
OR apply.status = 'pending'
OR (
apply.status = 'success'
AND learning.status
IS DISTINCT FROM
'success'
)
)
)
)
)
)
)
)
ORDER BY candidate.created_at DESC
LIMIT 1
"""),
@@ -1305,6 +1384,9 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
_EXECUTION_CAPABILITY_FALLBACK_OPERATION_TYPE
),
"freshness_hours": freshness_hours,
"retain_controlled_capability_owner": (
_catalog_id == _WAZUH_INGRESS_CATALOG_ID
),
"project_id": project_id,
"work_item_id": _work_item_id,
"proposal_source": _scheduler_source,
@@ -1325,6 +1407,29 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
latest_check_status = str(
existing_row.get("latest_check_status") or ""
) if existing_row else ""
check_controlled_apply_blocker = str(
existing_row.get("latest_check_controlled_apply_blocker") or ""
) if existing_row else ""
break_glass_approval_id = str(
existing_row.get("latest_check_break_glass_approval_id") or ""
) if existing_row else ""
break_glass_apply_authorized = bool(
existing_row
and existing_row.get("latest_check_break_glass_apply_authorized")
is True
)
break_glass_apply_terminal_status = str(
existing_row.get(
"latest_check_break_glass_apply_terminal_status"
)
or ""
) if existing_row else ""
latest_apply_status = str(
existing_row.get("latest_apply_status") or ""
) if existing_row else ""
latest_learning_status = str(
existing_row.get("latest_learning_status") or ""
) if existing_row else ""
retry_attempt_ref: str | None = None
retry_reason = _wazuh_posture_retry_reason(
existing_row,
@@ -1340,6 +1445,35 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
existing_row.get("latest_controlled_capability_failure_class")
or ""
) if existing_row else ""
capability_queue_status = str(
existing_row.get("latest_controlled_capability_queue_status")
or ""
) if existing_row else ""
raw_capability_retry_generation = str(
existing_row.get("latest_controlled_capability_retry_generation")
or "0"
) if existing_row else "0"
capability_retry_generation = (
int(raw_capability_retry_generation)
if raw_capability_retry_generation.isdigit()
else 0
)
capability_packet_retry_owned = bool(
existing_row
and str(
existing_row.get(
"latest_controlled_capability_packet_status"
)
or ""
)
== "pending"
and capability_queue_status in {"queued", "retry_exhausted"}
and capability_failure_class
in {
_WAZUH_PRIVILEGED_CONVERGENCE_CAPABILITY_MISSING,
_WAZUH_PRIVILEGED_CONVERGENCE_SECRET_REFERENCE_MISSING,
}
)
critical_secret_reference_pending = bool(
capability_failure_class
== _WAZUH_PRIVILEGED_CONVERGENCE_SECRET_REFERENCE_MISSING
@@ -1347,13 +1481,22 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
if (
_catalog_id == _WAZUH_INGRESS_CATALOG_ID
and retry_reason == "check_mode_failed"
and capability_packet_pending
and capability_packet_retry_owned
):
retry_exhausted = bool(
capability_queue_status == "retry_exhausted"
or capability_retry_generation
>= WAZUH_CONTROLLED_CAPABILITY_MAX_RETRIES
)
return {
"status": (
"critical_secret_reference_break_glass_already_queued"
if critical_secret_reference_pending
else "controlled_privilege_capability_repair_already_queued"
"controlled_capability_same_run_retry_exhausted"
if retry_exhausted
else (
"critical_secret_reference_break_glass_already_queued"
if critical_secret_reference_pending
else "controlled_privilege_capability_repair_already_queued"
)
),
"queued": 0,
"existing": 1,
@@ -1369,14 +1512,140 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
),
"retry_reason": retry_reason,
"retry_of_failed_check_mode": True,
"capability_packet_active": capability_packet_pending,
"capability_retry_generation": capability_retry_generation,
"active_blockers": [
(
"wazuh_critical_secret_reference_provisioning_pending"
if critical_secret_reference_pending
else "wazuh_controlled_privilege_capability_repair_pending"
"wazuh_same_run_capability_retry_exhausted"
if retry_exhausted
else (
"wazuh_critical_secret_reference_provisioning_pending"
if critical_secret_reference_pending
else "wazuh_controlled_privilege_capability_repair_pending"
)
)
],
}
if (
_catalog_id == _WAZUH_INGRESS_CATALOG_ID
and latest_check_status == "success"
and check_controlled_apply_blocker
== _WAZUH_CRITICAL_BREAK_GLASS_RECEIPTS_MISSING
):
return {
"status": "critical_secret_reference_break_glass_receipts_pending",
"queued": 0,
"existing": 1,
"evidence_ready": 1 if existing_evidence_ready else 0,
"automation_run_id": str(
existing_row.get("automation_run_id")
or existing_row.get("op_id")
or ""
),
"work_item_id": _work_item_id,
"controlled_apply_allowed": False,
"retry_reason": None,
"retry_of_failed_check_mode": True,
"capability_retry_generation": max(
capability_retry_generation,
int(
str(
existing_row.get(
"latest_check_capability_retry_generation"
)
or "0"
)
)
if str(
existing_row.get(
"latest_check_capability_retry_generation"
)
or "0"
).isdigit()
else 0,
),
"active_blockers": [check_controlled_apply_blocker],
"break_glass_approval_id": break_glass_approval_id,
"canonical_approval_url": (
"/zh-TW/awooop/approvals"
f"?project_id={project_id}"
f"&incident_id={str(existing_row.get('incident_id') or '')}"
),
}
if (
_catalog_id == _WAZUH_INGRESS_CATALOG_ID
and latest_check_status == "success"
and break_glass_apply_authorized
and break_glass_apply_terminal_status
):
return {
"status": "owner_authorized_break_glass_apply_blocked_terminal",
"queued": 0,
"existing": 1,
"evidence_ready": 1 if existing_evidence_ready else 0,
"automation_run_id": str(
existing_row.get("automation_run_id")
or existing_row.get("op_id")
or ""
),
"work_item_id": _work_item_id,
"controlled_apply_allowed": False,
"retry_reason": None,
"retry_of_failed_check_mode": True,
"break_glass_approval_id": break_glass_approval_id,
"active_blockers": [break_glass_apply_terminal_status],
}
if (
_catalog_id == _WAZUH_INGRESS_CATALOG_ID
and latest_check_status == "success"
and break_glass_apply_authorized
and latest_apply_status in {"", "pending"}
):
return {
"status": "owner_authorized_break_glass_apply_in_progress",
"queued": 0,
"existing": 1,
"evidence_ready": 1 if existing_evidence_ready else 0,
"automation_run_id": str(
existing_row.get("automation_run_id")
or existing_row.get("op_id")
or ""
),
"work_item_id": _work_item_id,
"controlled_apply_allowed": True,
"retry_reason": None,
"retry_of_failed_check_mode": True,
"break_glass_approval_id": break_glass_approval_id,
"active_blockers": [
"owner_authorized_break_glass_apply_receipt_pending"
],
}
if (
_catalog_id == _WAZUH_INGRESS_CATALOG_ID
and latest_check_status == "success"
and break_glass_apply_authorized
and latest_apply_status == "success"
and latest_learning_status != "success"
):
return {
"status": "same_run_break_glass_learning_writeback_pending",
"queued": 0,
"existing": 1,
"evidence_ready": 1 if existing_evidence_ready else 0,
"automation_run_id": str(
existing_row.get("automation_run_id")
or existing_row.get("op_id")
or ""
),
"work_item_id": _work_item_id,
"controlled_apply_allowed": True,
"retry_reason": "post_apply_learning_incomplete",
"retry_of_failed_check_mode": True,
"break_glass_approval_id": break_glass_approval_id,
"active_blockers": [
"same_run_break_glass_learning_writeback_pending"
],
}
if (
existing_row
and retry_reason is None