core.augur

Read-probe of live access to an external system (Vault / Prometheus / ELK) through the Augur broker. Soul-side.

Unlike the usual model (everything external is resolved by the server before the step is sent to the host), core.augur.fetch requests the value at apply time on the host — for cases that cannot be handed over in advance: a short-lived dynamic secret, a live metric as a step condition, a read from ELK during the run. The request goes through Keeper — the external credential never reaches the host.

A verb module: the only state is fetch. changed=false always, by construction.

States

State (verb)	Purpose	`changed`
`fetch`	Request a value from the external system via the Augur broker at apply time.	`false` always (a read-probe does not change the host).

Parameters

Param	Type	Required / default	Description
`omen`	string	required	Name of the external system (Omen) that access is requested to.
`query`	string	required	The query: a KV path (Vault, including a `#field` projection), PromQL (Prometheus), an index query (ELK). Checked against the allow-list on Keeper.

Error contract

The step fails (no value is returned) on any of:

denied — Keeper’s authorization rejected it (Omen not found / the host has no access / the query is outside the allow-list);
error — an execution failure on Keeper / the external system (unavailable);
default-deny — the absence of an explicit ok is treated as a denial;
the broker is unavailable during the run (push mode with no active session);
a timeout / disconnect before the response.

The error message carries the Omen name for diagnostics, but not the query and not the value itself.

Example

# Live read of a dynamic secret at apply time (data comes through Keeper).
- name: Fetch DB credentials at apply time
  module: core.augur.fetch
  register: db_creds
  params:
    omen: vault-prod
    query: database/creds/app-role#password

- name: Write app config
  module: core.file.rendered
  params:
    path: /etc/app/config.yml
    template: app-config.tmpl
    vars:
      db_password: "${ register.db_creds.value }"

Notes

The master credential never reaches the host — the host receives only the value inline through Keeper.
Authorization happens on Keeper, not on the host. The host sends the request; Keeper verifies the host’s identity (from the mTLS certificate) → permissions → allow-list. Any failed check → denial with no value. Default-deny: the absence of an explicit ok never “proceeds”.
Secret minimization in diagnostics — neither the query, nor the value, nor the token reach the error messages.
Output: on ok — inline_data as-is: a scalar is wrapped in { "value": <scalar> }, a map is a natural object. The #field projection is done by Keeper — the host receives the already-projected value.