mirror of https://github.com/hanzoai/insights.git synced 2026-10-30 16:15:31 +00:00

Files

T

History

zeekay 19fdf55ceb feat(auth): one key scheme, minted and read in one place

A key now opens with what it is allowed to touch. `pk-` is publishable and
safe in a browser; `sk-` is secret and never leaves a server. The five marks
it replaces all began `ph` -- the upstream's initials -- and they were the
last of its brand a customer read back to us, in every SDK snippet. No word
rule could reach them, because `ph` is not a word.

The marks were also not telling the truth. The constant said `phc_` while
every live project token said `hi_`, so the middleware that routes on the
constant matched no real token at all. Two spellings existed and one was
fiction. Minting now happens in exactly one function and reading in exactly
one, so a second spelling has nowhere to live.

`phx_` (personal) and `phs_` (project secret) both become `sk-`. The mark
now says only that a value is secret; which store holds it is settled by
asking. That was already how personal keys worked -- keys minted before the
marks carry none, so the store always decided -- and both secret resolvers
already returned None on a miss and fell through, so one shared extractor
replaces the two that could drift apart.

OAuth's access and refresh tokens stay distinguishable as `at-` and `rt-`,
because the parser tells them apart before either is looked up, and the
domain-verification token becomes `vt-` rather than keeping a sixth mint of
its own.

`bin/debrand --check` now refuses the marks as a shape, so a seventh cannot
be coined. Two rules that were about to rename things that are not ours to
spell are bounded: `Lemon` no longer eats `LemonSqueezy`, and the `hog_flow`
rules no longer reach a Postgres table, a Datastore table or a route.

Keys are stored hashed, so a mark cannot be rewritten in place: the three
live project tokens have to be reminted.

2026-08-08 19:42:44 -07:00

toolbox

feat(auth): one key scheme, minted and read in one place

2026-08-08 19:42:44 -07:00

README.md

chore: rebase the tree onto upstream master fa1a9a60

2026-08-06 01:25:36 -07:00

requirements.txt

…

run_tests.sh

…

test_toolbox.py

chore: rebase the tree onto upstream master fa1a9a60

2026-08-06 01:25:36 -07:00

toolbox.py

chore: rebase the tree onto upstream master fa1a9a60

2026-08-06 01:25:36 -07:00

README.md

Toolbox CLI

The primary function is to help manage and connect to Insights toolbox pods in a Kubernetes environment.

Installation

Ensure you have Python 3.x installed on your system
Clone this repository or download toolbox.py
Install dependencies (the Insights SDK, used for anonymous usage telemetry):
```
pip install -r requirements.txt
```
Make the script executable (Unix-based systems):
```
chmod +x toolbox.py
```

Requirements

Python 3.x
kubectl installed and configured
the Insights Python SDK (pip install -r requirements.txt) — telemetry is skipped gracefully if it's missing
a Fleet-managed kubeconfig with the standard Insights contexts

Usage

Run the script using Python:

python toolbox.py [flags]

Or directly (Unix-based systems):

./toolbox.py [flags]

What it Does

The toolbox CLI:

Asks whether you need dev, prod-eu, or prod-us
Selects the least-privileged usable -eks, -write, or -admin context
Guides you through requesting k8s + toolbox access in #aws-access when needed, waits up to 10 minutes for approval, and continues automatically
Finds an available Insights toolbox pod or connects to one you've already claimed
Claims the pod for a specified duration (default 12 hours)
Provides an interactive shell session to the pod
Offers to delete the pod when you exit the shell

Available Flags

Flag	Description	Default
`--claim-duration HOURS`	Number of hours to claim the pod for	12
`--update-claim`	Update the termination time of your existing pod	False

Set KUBE_CONTEXT to bypass environment selection for expert workflows. The context is scoped to this process and must have the pod permissions required by the toolbox; the CLI never changes your global current context.

Examples

Connect to a pod with default 12-hour claim:

python toolbox.py

Connect to a pod with a custom claim duration:

python toolbox.py --claim-duration 4

Extend the duration of your existing pod:

python toolbox.py --update-claim --claim-duration 24

Notes

If no pods are available, the script will wait up to 5 minutes for a pod to become available
When you exit the pod shell, you'll be prompted whether to delete the pod
If access is not approved within 10 minutes, the script exits with the profile-specific login command to use before retrying
If Kubernetes rejects stale cached credentials after access is renewed, the script first logs in again with the selected profile. If Kubernetes still rejects it, the script resets AWS SSO, logs in again, and continues
If something doesn't work as expected, reach out to #team-infrastructure for assistance