2026-05-26 02:36:04 +02:00
|
|
|
#!/usr/bin/env bash
|
2026-06-01 21:20:53 +02:00
|
|
|
# Patch the live KeyCape config Secret with non-secret code-defined settings:
|
2026-06-18 01:23:02 +02:00
|
|
|
# the OpenBao admin client, browser auth mount callbacks, and LLDAP OU lookup
|
|
|
|
|
# paths.
|
2026-05-26 02:36:04 +02:00
|
|
|
# This does not require decrypted bootstrap secrets and does not print existing
|
|
|
|
|
# Secret values.
|
|
|
|
|
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
|
|
|
|
|
NAMESPACE="${KEYCAPE_NAMESPACE:-sso}"
|
|
|
|
|
SECRET="${KEYCAPE_CONFIG_SECRET:-keycape-config}"
|
|
|
|
|
KUBECTL="${KUBECTL:-kubectl}"
|
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
|
|
|
|
|
|
"$KUBECTL" get secret "$SECRET" -n "$NAMESPACE" -o json \
|
|
|
|
|
| python3 "$SCRIPT_DIR/openbao-client-config.py" patch \
|
|
|
|
|
| "$KUBECTL" patch secret "$SECRET" -n "$NAMESPACE" --type merge --patch-file /dev/stdin
|
|
|
|
|
|
2026-06-01 21:20:53 +02:00
|
|
|
echo "Patched $NAMESPACE/$SECRET with the openbao-admin client and LLDAP OU lookup settings."
|
