tegwick
21d46927f6
Ship ExternalSecret actcore-forgejo-admin and multi-policy ESO token bootstrap so weekly prune credentials refresh without bootstrap inject. Disposition issue-core path A and MarkiTect ROS as external owners; close workplan finished.
76 lines
2.8 KiB
Bash
Executable file
76 lines
2.8 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Mint a read-limited OpenBao token on coulombcore (bao.coulomb.social) and store
|
|
# it on railiance01 for ClusterSecretStore openbao-activity-core / ExternalSecrets:
|
|
# - actcore-issue-core-runtime (ISSUE_CORE_API_KEY)
|
|
# - actcore-forgejo-admin (FORGEJO_TOKEN for package prune)
|
|
#
|
|
# Default policies (already present in OpenBao; files re-written when present):
|
|
# workload-kv-read-issue-core-runtime
|
|
# workload-kv-read-forgejo-admin
|
|
set -euo pipefail
|
|
|
|
# Space-separated policy names. Override with OPENBAO_ACTIVITY_CORE_POLICIES.
|
|
DEFAULT_POLICIES="workload-kv-read-issue-core-runtime workload-kv-read-forgejo-admin"
|
|
POLICIES="${OPENBAO_ACTIVITY_CORE_POLICIES:-$DEFAULT_POLICIES}"
|
|
POLICY_DIR="${OPENBAO_POLICY_DIR:-$HOME/railiance-platform/openbao/policies}"
|
|
BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
|
|
RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
|
|
SECRET_NAME="${OPENBAO_ACTIVITY_CORE_ESO_SECRET:-openbao-activity-core-eso-token}"
|
|
SECRET_NS="${OPENBAO_ACTIVITY_CORE_ESO_NAMESPACE:-external-secrets}"
|
|
|
|
if ! command -v bao >/dev/null 2>&1; then
|
|
echo "ERROR: bao CLI not found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "OpenBao addr: $BAO_ADDR"
|
|
echo "Policies: $POLICIES"
|
|
|
|
if [[ -n "${BAO_TOKEN:-}" ]]; then
|
|
:
|
|
elif [[ -n "${OPENBAO_TOKEN_FILE:-}" && -f "${OPENBAO_TOKEN_FILE}" ]]; then
|
|
BAO_TOKEN="$(head -n 1 "${OPENBAO_TOKEN_FILE}")"
|
|
else
|
|
read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
|
|
echo >&2
|
|
fi
|
|
|
|
if [[ -z "${BAO_TOKEN:-}" ]]; then
|
|
echo "ERROR: empty OpenBao token" >&2
|
|
exit 1
|
|
fi
|
|
|
|
export BAO_ADDR BAO_TOKEN
|
|
|
|
health="$(curl -fsS "$BAO_ADDR/v1/sys/health")"
|
|
if echo "$health" | grep -q '"sealed":true'; then
|
|
echo "ERROR: OpenBao at $BAO_ADDR reports sealed" >&2
|
|
exit 1
|
|
fi
|
|
|
|
policy_flags=()
|
|
for policy in $POLICIES; do
|
|
policy_file="$POLICY_DIR/${policy}.hcl"
|
|
if [[ -f "$policy_file" ]]; then
|
|
bao policy write "$policy" "$policy_file"
|
|
else
|
|
echo "WARN: policy file missing ($policy_file); using existing OpenBao policy '$policy'" >&2
|
|
fi
|
|
policy_flags+=(-policy="$policy")
|
|
done
|
|
|
|
token_json="$(bao token create "${policy_flags[@]}" \
|
|
-display-name="eso-activity-core-runtime" \
|
|
-period=720h \
|
|
-format=json)"
|
|
token="$(python3 -c "import json,sys; print(json.load(sys.stdin)['auth']['client_token'])" <<<"$token_json")"
|
|
|
|
KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create namespace "$SECRET_NS" --dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
|
|
KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create secret generic "$SECRET_NAME" \
|
|
--namespace "$SECRET_NS" \
|
|
--from-literal=token="$token" \
|
|
--dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
|
|
|
|
unset BAO_TOKEN token token_json
|
|
echo "ok: applied $SECRET_NS/$SECRET_NAME on railiance01 (token not printed)"
|
|
echo "ok: policies attached: $POLICIES"
|