admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: REPORT + README for v0.44.0 capability self-probe

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt
This commit is contained in:
authentik Default Admin
2026-06-29 18:57:22 +02:00
parent 25024d9dda
commit 61c89a7efa
2 changed files with 79 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+18
View File
@@ -23,9 +23,27 @@ internal/authz/ # operator signed-op verifier (SSHSIG); durable nonce sto
internal/hub/ # daemon: host-report collector + Bearer client + resilient poll loop
internal/reconcile/ # reconcile engine + reversibility gate + op journal + crash recovery
internal/storage/ # storage-target observer + durable_id + fast-poll watchdog (slice 5)
internal/capability/ # privileged-capability self-probe (manifest + sudo -n -l check, v0.44.0)
configs/agent.example.json
```
## The `capability` package — privileged self-check (v0.44.0)
The non-root agent depends on a fixed set of `sudo -n` grants (`configs/felhom-agent.sudoers`). When
the 2026-06-28 root→non-root cutover silently dropped some (lxc-info, make-private, …), features broke
unnoticed until a user hit them. `internal/capability` makes that loud:
- **`Manifest()` is the source of truth** for the required `(binary, representative-arg)` vectors,
seeded from the sudoers audit (the OK + CLOSED rows; the surfaced/deferred rows are excluded). When
you add a privileged `runner.Run` call that needs a NEW grant, add it to BOTH the sudoers file AND
the manifest — `manifest_test.go` asserts **manifest ⊆ sudoers** at build time (with a red-proof
that dropping the lxc-info grant fails the gate), so a missing grant is caught in CI, not in prod.
- **`Prober.Probe`** lists each vector with `sudo -n -l` (a policy LIST — never executes, safe for
mkfs/pct) + an `os.Stat` existence check → an `ok`/`degraded` snapshot. It runs at startup (logged
loud) and on every collect, riding the hub report as `HostReport.Capabilities`; the hub
(`HostCapabilityChecker`) alerts the operator on a Critical capability going degraded. Serve-degraded
— the probe never blocks startup. (Next self-health slice: the controller↔agent channel check.)
## The `storage` package — observe + watchdog (slice 5)
Read-only this slice (no hub desired-state until slice 10):