47 lines
2.2 KiB
Bash
47 lines
2.2 KiB
Bash
#!/bin/bash
|
|
# OpenBao Vault operations and Kubernetes Secret synchronization
|
|
|
|
sync_k8s_vault_token() {
|
|
if kubectl --request-timeout=2s cluster-info >/dev/null 2>&1; then
|
|
log_info "Синхронизация токена OpenBao в Kubernetes..."
|
|
local bao_tok
|
|
bao_tok=$(grep '^export VAULT_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'")
|
|
if [[ -n "${bao_tok}" ]]; then
|
|
kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f - >/dev/null 2>&1 || true
|
|
kubectl -n external-secrets create secret generic openbao-token \
|
|
--from-literal=token="${bao_tok}" \
|
|
--dry-run=client -o yaml | kubectl apply -f - >/dev/null 2>&1
|
|
kubectl -n external-secrets rollout restart deployment external-secrets >/dev/null 2>&1 || true
|
|
log_ok "Токен OpenBao в Kubernetes актуализирован."
|
|
fi
|
|
fi
|
|
}
|
|
|
|
unseal_vault() {
|
|
local unseal_key target_vault_addr seal_status resp
|
|
unseal_key=$(grep '^export VAULT_UNSEAL_KEY=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'")
|
|
target_vault_addr=$(grep '^export VAULT_ADDR=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'")
|
|
target_vault_addr="${target_vault_addr:-$VAULT_ADDR}"
|
|
|
|
seal_status=$(curl -s --connect-timeout 2 "${target_vault_addr}/v1/sys/seal-status" 2>/dev/null || echo "")
|
|
if [[ -z "${seal_status}" ]]; then
|
|
log_warn "OpenBao (${target_vault_addr}) недоступен. Пропуск ансила."
|
|
return 0
|
|
fi
|
|
|
|
if echo "${seal_status}" | grep -q '"sealed":true'; then
|
|
log_info "OpenBao запечатан. Ансил..."
|
|
resp=$(printf '{"key":"%s"}' "${unseal_key}" | curl -s -X POST -H "Content-Type: application/json" --data-binary @- "${target_vault_addr}/v1/sys/unseal")
|
|
if echo "${resp}" | grep -q '"sealed":false'; then
|
|
log_ok "OpenBao успешно распечатан."
|
|
sync_k8s_vault_token
|
|
else
|
|
log_err "Ошибка ансила OpenBao: ${resp}"
|
|
return 1
|
|
fi
|
|
else
|
|
log_ok "OpenBao распечатан."
|
|
sync_k8s_vault_token
|
|
fi
|
|
}
|