tegwick
4e7f04d0b7
Parse the four Terraform fields and bao kv put via @file. Never print values. Operator runs this; agents do not.
54 lines
1.8 KiB
Bash
Executable file
54 lines
1.8 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Founder-only. Reads a local scaleway.auto.tfvars (or equivalent) and
|
|
# writes the four fields to OpenBao. Never prints values. Never commit
|
|
# the tfvars file.
|
|
set -euo pipefail
|
|
|
|
TFVARS="${1:-}"
|
|
[[ -n "$TFVARS" && -f "$TFVARS" ]] || {
|
|
echo "usage: $0 /path/to/scaleway.auto.tfvars" >&2
|
|
exit 2
|
|
}
|
|
command -v bao >/dev/null || { echo "missing bao" >&2; exit 2; }
|
|
|
|
mapfile -t EXPORTS < <(python3 - "$TFVARS" <<'PY'
|
|
import re, json, sys
|
|
text = open(sys.argv[1], encoding="utf-8").read()
|
|
# HCL-ish: key = "value" (ignore comments and the main.tf provider block)
|
|
found = {}
|
|
for name, dest in (
|
|
("access_key", "ACCESS_KEY"),
|
|
("secret_key", "SECRET_KEY"),
|
|
("organization_id", "DEFAULT_ORGANIZATION_ID"),
|
|
("project_id", "DEFAULT_PROJECT_ID"),
|
|
):
|
|
m = re.search(rf'(?m)^\s*{name}\s*=\s*"([^"]*)"\s*$', text)
|
|
if not m or not m.group(1) or m.group(1) in {"xxx", "redacted"}:
|
|
sys.stderr.write(f"missing or placeholder field: {name}\n")
|
|
sys.exit(4)
|
|
found[dest] = m.group(1)
|
|
for dest, val in found.items():
|
|
print(f"{dest}={json.dumps(val)}")
|
|
PY
|
|
)
|
|
|
|
# Write via env to bao without putting values on argv.
|
|
# bao kv put supports @file; we use a mode-0600 temp dir.
|
|
umask 077
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
for line in "${EXPORTS[@]}"; do
|
|
field="${line%%=*}"
|
|
python3 -c 'import json,os,sys; open(sys.argv[2],"w").write(json.loads(sys.argv[1]))' \
|
|
"${line#*=}" "$tmp/$field"
|
|
done
|
|
|
|
bao kv put platform/workloads/railiance/scaleway/bootstrap \
|
|
ACCESS_KEY=@"$tmp/ACCESS_KEY" \
|
|
SECRET_KEY=@"$tmp/SECRET_KEY" \
|
|
DEFAULT_ORGANIZATION_ID=@"$tmp/DEFAULT_ORGANIZATION_ID" \
|
|
DEFAULT_PROJECT_ID=@"$tmp/DEFAULT_PROJECT_ID"
|
|
|
|
echo "wrote four fields to platform/workloads/railiance/scaleway/bootstrap"
|
|
bao kv metadata get platform/workloads/railiance/scaleway/bootstrap
|
|
echo "shred or keep your tfvars; do not commit it"
|