26 lines
1.2 KiB
Bash
26 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Safe diagnostics only: artifact existence/readability and mount topology.
|
|
# This script never reads or prints credential content.
|
|
TOKEN_PATH="/run/control-plane-secrets/control_plane_service_token"
|
|
VOLUME="assistant_control_plane_service_secrets"
|
|
authorized=(assistant-core-runtime-1 assistant-commit-runtime-1)
|
|
unauthorized=(assistant-creator-web-1 assistant-cognitive-worker-1 assistant-research-runtime-1 assistant-continuity-runtime-1 assistant-agent-worker-1)
|
|
|
|
for container in "${authorized[@]}"; do
|
|
docker inspect "$container" >/dev/null
|
|
docker exec "$container" sh -c "test -r '$TOKEN_PATH'"
|
|
docker inspect -f '{{range .Mounts}}{{if eq .Name "assistant_control_plane_service_secrets"}}{{.Destination}} {{.RW}}{{end}}{{end}}' "$container" | grep -qx '/run/control-plane-secrets false'
|
|
done
|
|
|
|
for container in "${unauthorized[@]}"; do
|
|
docker inspect "$container" >/dev/null
|
|
if docker inspect -f '{{range .Mounts}}{{println .Name}}{{end}}' "$container" | grep -qx "$VOLUME"; then
|
|
echo "unauthorized runtime has the control-plane credential mount" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
echo "machine credential mount topology verified"
|