Crate krabka_guard 

Administers krabka topic write freezes and break-glass proposals.

A write freeze is a broker-owned state where the cluster is up, every read works, and the broker refuses every new client write to a topic. A break-glass proposal is a standing authorization that two different people agreed to, which a privileged transition spends. This is the operator’s side of both: freeze a scope, read the registry back and prove it, lift a freeze with an approval, and open, approve, withdraw and read the proposals.

It is one command for one incident. It is a library as well as a binary so tests call run_from_args in process: a test that spawns the binary needs a Cargo working tree to build it from, and a Bazel test sandbox has none. That is the same reason krabka-barrier and krabka-format are libraries.

The two properties that matter

--sign-with never leaves the machine. It takes a PKCS#8 Ed25519 key file, builds the canonical signing bytes here, signs them here, and puts only the key_id and the detached signature on the wire. The private key never reaches a broker, so a broker cannot make a signature in an operator’s name.

freeze list --verify-signatures checks the registry here as well, against operator public keys on this machine. That makes the operator’s own machine, and not the broker that served the rows, the thing that says the registry is authentic.

Exit codes

A runbook branches on $?, so every number means one thing across this tool and krabka-barrier. See EXIT_REFUSED, EXIT_UNREACHABLE, EXIT_MISMATCH, EXIT_NO_APPROVAL and EXIT_BAD_SIGNATURE.

The api keys

Every subcommand speaks one krabka-private api key, in the 1015 to 1019 range. A JVM AdminClient cannot send those. The freeze is visible to the JVM tools another way: DescribeConfigs reports a read-only write.freeze key for every topic, so kafka-configs --describe shows it.

Re-exports

pub use self::verify::CheckedEntry;

pub use self::verify::Unproved;

pub use self::verify::VerifyOutcome;

Modules

signing

The canonical bytes an operator signs, built on the operator’s own machine.

verify

Proves the freeze registry against operator public keys on this machine.

Structs

Cli

The tool’s command line.

FreezeSigningArgs

The detached operator signature on a freeze or a thaw.

ScopeArgs

The scope a freeze command acts on.

Enums

Action

A gated transition that a break-glass proposal authorizes.

BreakGlassCommand

The break-glass subcommands.

Command

The two halves of the tool.

FreezeCommand

The freeze registry subcommands.

Constants

EXIT_BAD_SIGNATURE

The exit code for a signature that did not verify, or that the broker needed and did not get.

EXIT_MISMATCH

The exit code for a registry the local trust set does not match.

EXIT_NO_APPROVAL

The exit code for an action that needs a break-glass approval which does not exist.

EXIT_REFUSED

The exit code for a request the broker refused.

EXIT_UNREACHABLE

The exit code for a transport failure, where nothing is known about the request’s outcome.

Functions

action_name

The name of an action wire value, in the spelling every krabka surface uses.

code_name

Describe an error code.

exit_for_code

The exit code that one broker error code becomes.

pattern_name

The word for a pattern-type wire value.

run

Run one parsed command.

run_from_args

Run the tool from an argv-style iterator, returning its exit code.