wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(security): restrict executor SSH egress
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m32s
Details
CD Pipeline / build-and-deploy (push) Failing after 6m7s
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details

Browse Source
This commit is contained in:
ogt
2026-07-11 01:42:00 +08:00
parent da42d9a7fc
commit 85159f25a0
9 changed files with 284 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apps/api/src/services/executor_trust_boundary_readback.py
View File

@@ -13,8 +13,8 @@ import structlog
logger = structlog.get_logger(__name__)
SCHEMA_VERSION = "awoooi_executor_trust_boundary_readback_v1"
RECEIPT_SCHEMA_VERSION = "awoooi_executor_boundary_verification_v1"
SCHEMA_VERSION = "awoooi_executor_trust_boundary_readback_v2"
RECEIPT_SCHEMA_VERSION = "awoooi_executor_boundary_verification_v2"
DEFAULT_NAMESPACE = "awoooi-prod"
DEFAULT_CONFIGMAP_NAME = "awoooi-executor-boundary-verification"
_CACHE_TTL_SECONDS = 20.0
@@ -27,6 +27,10 @@ _REQUIRED_TRUE_FIELDS = (
"broker_kubernetes_token_absent",
"broker_ssh_mount_present",
"legacy_executor_binding_absent",
"api_ssh_egress_denied",
"worker_ssh_egress_denied",
"broker_ssh_egress_allowlisted",
"legacy_namespace_egress_allow_absent",
)
_cache: tuple[float, dict[str, Any]] | None = None