# aep-op may run the root side of aep-op-dispatch and nothing else, one rule
# per verb (design §4.4). The root side validates every argument again; the
# forced command of the SSH login is the user side. Shipped by the package
# aep-op-dispatch; the user aep-op, its SSH trust (TrustedUserCAKeys,
# AuthorizedPrincipals) and dispatch.conf values come from Puppet.
# No Defaults line: sudo-rs (default on resolute) rejects "!requiretty"
# ("invalid sudoers file"), and requiretty is off anyway; env_reset is the
# default of both sudo implementations.
Cmnd_Alias AEP_OP_VERBS = \
    /usr/sbin/aep-op-dispatch --exec health, \
    /usr/sbin/aep-op-dispatch --exec facts, \
    /usr/sbin/aep-op-dispatch --exec puppet-report, \
    /usr/sbin/aep-op-dispatch --exec post-check, \
    /usr/sbin/aep-op-dispatch --exec kube-apply *, \
    /usr/sbin/aep-op-dispatch --exec kube-get *, \
    /usr/sbin/aep-op-dispatch --exec kube-status *, \
    /usr/sbin/aep-op-dispatch --exec kube-secret-put *, \
    /usr/sbin/aep-op-dispatch --exec kube-count *, \
    /usr/sbin/aep-op-dispatch --exec kube-delete-namespace *, \
    /usr/sbin/aep-op-dispatch --exec etcd-health, \
    /usr/sbin/aep-op-dispatch --exec puppet-noop *, \
    /usr/sbin/aep-op-dispatch --exec puppet-apply *, \
    /usr/sbin/aep-op-dispatch --exec survey *, \
    /usr/sbin/aep-op-dispatch --exec svctl-status *, \
    /usr/sbin/aep-op-dispatch --exec svc-log *, \
    /usr/sbin/aep-op-dispatch --exec svctl-restart *, \
    /usr/sbin/aep-op-dispatch --exec install-credential *, \
    /usr/sbin/aep-op-dispatch --exec reboot-request *, \
    /usr/sbin/aep-op-dispatch --exec r10k-deploy *, \
    /usr/sbin/aep-op-dispatch --exec r10k-status *, \
    /usr/sbin/aep-op-dispatch --exec cert-clean *, \
    /usr/sbin/aep-op-dispatch --exec catalog-compile *
aep-op ALL=(root) NOPASSWD: AEP_OP_VERBS
