From 4b2b72a81cc3c051e033fa935e6438491456c254 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 20 Oct 2026 23:21:40 +0200 Subject: [PATCH] openbao-apply-ssh-engine: role writer passed 'bao' twice (exit 127) The exec wrapper already runs bao; the role command prefixed another 'bao', so every role write failed with usage text and no role was ever written by this script (found during CUST-WP-0073 step 1). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61 --- scripts/openbao-apply-ssh-engine.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/openbao-apply-ssh-engine.sh b/scripts/openbao-apply-ssh-engine.sh index 1b78cc4..db9f2bc 100755 --- a/scripts/openbao-apply-ssh-engine.sh +++ b/scripts/openbao-apply-ssh-engine.sh @@ -189,7 +189,8 @@ spec = yaml.safe_load(open(spec_path)) roles = spec.get("roles") or {} for role_name, params in roles.items(): args = [f"{k}={v}" for k, v in params.items()] - cmd = ["bao", "write", f"{mount}/roles/{role_name}"] + args + # The exec wrapper below already runs `bao`; pass only its arguments. + cmd = ["write", f"{mount}/roles/{role_name}"] + args proc = subprocess.run( kubectl_parts + ["exec", "-i", "-n", namespace, pod, "--", "sh", "-c", "read -r BAO_TOKEN; export BAO_TOKEN; exec bao \"$@\"", "sh"] + cmd,