91 lines
2.6 KiB
Python
91 lines
2.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Fixed-audience JWT-SVID broker for nested Gitea job containers."""
|
|
|
|
import asyncio
|
|
import json
|
|
import os
|
|
|
|
from aiohttp import web
|
|
|
|
SPIRE_AGENT = os.environ.get("SPIRE_AGENT", "/opt/spire/bin/spire-agent")
|
|
SPIRE_SOCKET = os.environ.get(
|
|
"SPIRE_SOCKET", "/run/spire/agent-sockets/spire-agent.sock"
|
|
)
|
|
AUDIENCE = os.environ.get("JWT_AUDIENCE", "zot")
|
|
MAX_CONCURRENCY = int(os.environ.get("MAX_CONCURRENCY", "4"))
|
|
semaphore = asyncio.Semaphore(MAX_CONCURRENCY)
|
|
|
|
|
|
def extract_svid(document: object) -> str:
|
|
if not isinstance(document, list):
|
|
raise ValueError("unexpected SPIRE response")
|
|
for item in document:
|
|
if not isinstance(item, dict):
|
|
continue
|
|
svids = item.get("svids")
|
|
if not isinstance(svids, list):
|
|
continue
|
|
for svid in svids:
|
|
if isinstance(svid, dict) and isinstance(svid.get("svid"), str):
|
|
return svid["svid"]
|
|
raise ValueError("SPIRE response contains no JWT-SVID")
|
|
|
|
|
|
async def fetch_svid() -> str:
|
|
async with semaphore:
|
|
process = await asyncio.create_subprocess_exec(
|
|
SPIRE_AGENT,
|
|
"api",
|
|
"fetch",
|
|
"jwt",
|
|
"-output",
|
|
"json",
|
|
"-audience",
|
|
AUDIENCE,
|
|
"-socketPath",
|
|
SPIRE_SOCKET,
|
|
stdout=asyncio.subprocess.PIPE,
|
|
stderr=asyncio.subprocess.PIPE,
|
|
)
|
|
stdout, stderr = await asyncio.wait_for(process.communicate(), timeout=10)
|
|
if process.returncode != 0:
|
|
message = stderr.decode(errors="replace").strip()
|
|
raise RuntimeError(f"SPIRE agent failed: {message}")
|
|
return extract_svid(json.loads(stdout))
|
|
|
|
|
|
async def token(_: web.Request) -> web.Response:
|
|
try:
|
|
value = await fetch_svid()
|
|
except (RuntimeError, ValueError, json.JSONDecodeError, asyncio.TimeoutError):
|
|
raise web.HTTPServiceUnavailable(text="identity unavailable\n")
|
|
return web.Response(
|
|
text=f"{value}\n",
|
|
content_type="text/plain",
|
|
headers={"Cache-Control": "no-store"},
|
|
)
|
|
|
|
|
|
async def health(_: web.Request) -> web.Response:
|
|
return web.Response(text="ok\n")
|
|
|
|
|
|
def create_app() -> web.Application:
|
|
app = web.Application(client_max_size=1024)
|
|
app.router.add_post("/token", token)
|
|
app.router.add_get("/healthz", health)
|
|
return app
|
|
|
|
|
|
def main() -> None:
|
|
web.run_app(
|
|
create_app(),
|
|
host=os.environ.get("LISTEN", "0.0.0.0"),
|
|
port=int(os.environ.get("PORT", "8788")),
|
|
access_log=None,
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|