coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close SECRETS-WP-0003 whynot-design real publish pilot

Browse source 
Apply, provision, and verify the prod lane on live OpenBao, publish
@whynot/design@0.4.1 through native secrets-engine exec, and teach the
OpenBao client to tolerate stage-role mount/approle probes when sys/mounts
and sys/auth are denied.
This commit is contained in:
tegwick 2026-07-03 17:04:19 +02:00
parent 0bf33a9a96
commit 32dfd4c78b
3 changed files with 78 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/secrets_engine/openbao.py
View file

@ -140,8 +140,14 @@ class OpenBaoClient:
except json.JSONDecodeError:
pass
enable = self._run(["auth", "enable", "approle"])
if enable.returncode != 0 and "already in use" not in enable.stderr:
raise BackendError(f"could not enable approle: {enable.stderr.strip()}")
if enable.returncode == 0:
return
stderr = enable.stderr or ""
if "already in use" in stderr:
return
if "permission denied" in stderr.lower():
return
raise BackendError(f"could not enable approle: {stderr.strip()}")
def write_approle(
self,
@ -234,8 +240,17 @@ class OpenBaoClient:
if self.kv_mount_exists(mount):
return
enable = self._run(["secrets", "enable", "-path", mount, "kv-v2"])
if enable.returncode != 0 and "already in use" not in enable.stderr:
raise BackendError(f"could not enable kv at {mount}: {enable.stderr.strip()}")
if enable.returncode == 0:
return
stderr = enable.stderr or ""
if "already in use" in stderr:
return
# Stage roles (e.g. secrets-engine-prod) cannot manage sys/mounts. When the
# caller also cannot list mounts, a permission-denied enable means the mount
# was operator-preprovisioned — continue to policy/approle apply.
if "permission denied" in stderr.lower():
return
raise BackendError(f"could not enable kv at {mount}: {stderr.strip()}")
def kv_put(self, mount: str, path: str, field: str, value: str) -> None:
"""Write a single field. `value` is a secret and is passed via stdin-free