41 lines
1.4 KiB
Bash
41 lines
1.4 KiB
Bash
|
#!/bin/sh
|
||
|
|
# ACTIVITY-WP-0039-T03 (option b): mint fresh ops_run worker tokens into OpenBao.
|
||
|
|
#
|
||
|
|
# Founder-attended only, through the silent admin lane (orientation section 5):
|
||
|
|
#
|
||
|
|
# BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
|
||
|
|
# warden access openbao-platform-admin-login --exec -- \
|
||
|
|
# sh scripts/wp0039-seed-worker-tokens.sh
|
||
|
|
#
|
||
|
|
# Silent by design: warden fails closed on any child output. The value is
|
||
|
|
# generated inside a pipe and sent to bao on stdin, so it never appears in
|
||
|
|
# argv, output, Git, or the hub. Idempotent: an existing path is never
|
||
|
|
# overwritten. Rerunning after success is a no-op that re-verifies.
|
||
|
|
#
|
||
|
|
# Exit codes: 0 both paths present and verified · 3 a path exists without a
|
||
|
|
# usable token field (left untouched) · 4 write failed · 5 verification failed.
|
||
|
|
exec >/dev/null 2>&1
|
||
|
|
set -u
|
||
|
|
|
||
|
|
MOUNT=platform
|
||
|
|
BASE=workloads/activity-core/ops-run-workers
|
||
|
|
PATHS="rein-aharness-railiance01 rein-aharness-metered-railiance01"
|
||
|
|
|
||
|
|
token_len() {
|
||
|
|
bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>/dev/null | tr -d '\n' | wc -c
|
||
|
|
}
|
||
|
|
|
||
|
|
for slug in $PATHS; do
|
||
|
|
if bao kv metadata get -mount="$MOUNT" "$BASE/$slug"; then
|
||
|
|
[ "$(token_len "$slug")" -eq 64 ] || exit 3
|
||
|
|
continue
|
||
|
|
fi
|
||
|
|
openssl rand -hex 32 | tr -d '\n' \
|
||
|
|
| bao kv put -mount="$MOUNT" "$BASE/$slug" token=- || exit 4
|
||
|
|
done
|
||
|
|
|
||
|
|
for slug in $PATHS; do
|
||
|
|
[ "$(token_len "$slug")" -eq 64 ] || exit 5
|
||
|
|
done
|
||
|
|
exit 0
|