coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Export BAO_ADDR in the parent before attended sender mint

Browse source 
warden access runs OIDC from the caller environment. Putting BAO_ADDR
only on the child env argv leaves bao login talking to the wrong
address, which fails before command handoff.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
This commit is contained in:
tegwick 2026-09-15 21:42:01 +02:00
parent 46d55ba8e0
commit 7c0f270b44
1 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/attended-mint-tenant-engine-sender.sh Executable file
View file

@ -0,0 +1,17 @@
#!/usr/bin/env bash
# Parent-env wrapper for the attended tenant-engine sender mint.
#
# `warden access` runs OIDC from the *caller* environment, not from the
# `env ...` child argv. BAO_ADDR must be set here or bao login talks to
# the wrong address and fails before the mint script starts.
set -euo pipefail
export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
export WARDEN_ROUTING_CATALOG="${WARDEN_ROUTING_CATALOG:-$HOME/ops-warden/registry/routing/catalog.yaml}"
cd "$(dirname "$0")/.."
exec warden access openbao-platform-admin-login --exec -- \
env RAILIANCE01_KUBECONFIG="$RAILIANCE01_KUBECONFIG" \
BAO_ADDR="$BAO_ADDR" \
VAULT_ADDR="$VAULT_ADDR" \
"$PWD/scripts/mint-tenant-engine-sender.py"