mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5
d86913225b
compare_application_keys skips generated credentials because no default exists for a secret, but it recognised them by the pre-rename prefix. Once the generator started writing them again, every credential arrived as secrets.credentials.<key> and the exemption stopped matching, so validation rejected three keys per credential -- the leaf and both intermediate nodes, which recursive_keys emits separately -- and aborted the deploy before the playbook ran. The condition now admits the bare secrets node and the secrets.credentials subtree, leaving a sibling such as secrets.other flagged. The check in the inventory manager stays on the bare prefix on purpose: it walks meta/secrets.yml, whose own root key is credentials. test_credentials_keys_are_skipped fed the validator the old shape, so it kept passing while real inventories were being rejected. Evidence: run 31655559799, job 94311023723, "Missing default for web-app-dashboard: secrets.credentials.sso_proxy_cookie_secret". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
32 lines
1.3 KiB
Python
32 lines
1.3 KiB
Python
"""Application-block validation: host_vars keys vs role contract."""
|
||
|
||
from __future__ import annotations
|
||
|
||
from utils.manager.credential_key import OVERRIDE_SECTION, SECRETS_KEY
|
||
|
||
from .keys import recursive_keys
|
||
|
||
|
||
def compare_application_keys(applications, application_defaults, source, variants=None):
|
||
"""Variants.yml is part of the role contract: a variant overlay may
|
||
legitimately introduce service-keys absent from meta/services.yml
|
||
(e.g. roles/web-opt-rdr-www declares services.dashboard only in
|
||
meta/variants.yml). Widen the allow-set to defaults ∪ union(variant
|
||
overlays) so host_vars baked by matrix-deploy from variants.yml
|
||
aren't flagged as "Missing default"."""
|
||
variants = variants or {}
|
||
errs: list[str] = []
|
||
for app_id, conf in applications.items():
|
||
if app_id not in application_defaults:
|
||
errs.append(f"{source}: Unknown application '{app_id}'")
|
||
continue
|
||
legal_keys = recursive_keys(application_defaults[app_id])
|
||
for variant in variants.get(app_id, []):
|
||
legal_keys |= recursive_keys(variant)
|
||
for key in recursive_keys(conf):
|
||
if key == SECRETS_KEY or key.startswith(OVERRIDE_SECTION):
|
||
continue
|
||
if key not in legal_keys:
|
||
errs.append(f"{source}: Missing default for {app_id}: {key}")
|
||
return errs
|