Infrastructure Security and Compliance Questions

# rotate_password.py
import os, subprocess, requests, json, logging, smtplib
from datetime import datetime
from secrets import token_urlsafe

DB_HOST = "db.example.local"
DB_USER = "svc_user"
K8S_SECRET = "namespace/secret-name"
SLACK_WEBHOOK = os.environ.get("SLACK_WEBHOOK")
ADMIN_EMAIL = "ops@example.com"

def generate_password():
    return token_urlsafe(24)

def update_db_password(new_pw):
    # call DB admin CLI or API; return True on success
    cmd = ["db-admin", "set-password", "--host", DB_HOST, "--user", DB_USER, "--password", new_pw]
    return subprocess.run(cmd, check=False).returncode == 0

def update_k8s_secret(new_pw):
    # kubectl patch secret with base64; or use kubeclient
    patch = {"data": {"password": new_pw.encode("utf-8").hex()}}  # pseudo-encoding
    return subprocess.run(["kubectl","patch","secret",K8S_SECRET,"--patch",json.dumps(patch)]).returncode == 0

def run_health_checks():
    services = ["https://svc1.example/health","https://svc2.example/health"]
    for url in services:
        r = requests.get(url, timeout=5)
        if r.status_code != 200 or r.json().get("status")!="ok":
            return False, url
    return True, None

def notify(msg):
    if SLACK_WEBHOOK:
        requests.post(SLACK_WEBHOOK, json={"text": msg})
    # fallback email (simplified)
    # send mail to ADMIN_EMAIL

def rollback(old_pw):
    update_db_password(old_pw)
    update_k8s_secret(old_pw)
    notify(f"Rollback performed at {datetime.utcnow().isoformat()}")

def main():
    old_pw = "<read current secret from store>"
    new_pw = generate_password()
    notify(f"Starting rotation for {DB_USER}")
    if not update_db_password(new_pw):
        notify("DB password update failed"); return 1
    if not update_k8s_secret(new_pw):
        notify("Secret store update failed; rolling back"); rollback(old_pw); return 1
    ok, bad = run_health_checks()
    if not ok:
        notify(f"Health check failed for {bad}; rolling back")
        rollback(old_pw)
        return 1
    notify("Password rotation successful")

if __name__ == "__main__":
    main()