bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

comms: ensure mas password is url-safe

Browse Source
This commit is contained in:
Brad Stein 2026-01-08 03:23:09 -03:00
parent e384a9e417
commit 05c2d245b9
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
services/comms/mas-db-ensure-job.yaml
View File

@ -2,7 +2,7 @@
apiVersion: batch/v1 apiVersion: batch/v1
kind: Job kind: Job
metadata: metadata:
name: mas-db-ensure-13 name: mas-db-ensure-14
namespace: comms namespace: comms
spec: spec:
backoffLimit: 1 backoffLimit: 1
@ -20,11 +20,21 @@ spec:
set -eu set -eu
trap 'echo "mas-db-ensure failed"; sleep 300' ERR trap 'echo "mas-db-ensure failed"; sleep 300' ERR
umask 077 umask 077
safe_pass() {
head -c 32 /dev/urandom | base64 | tr -d '\n' | tr '+/' '-_' | tr -d '='
}
EXISTING_B64="$(kubectl -n comms get secret mas-db -o jsonpath='{.data.password}' 2>/dev/null || true)" EXISTING_B64="$(kubectl -n comms get secret mas-db -o jsonpath='{.data.password}' 2>/dev/null || true)"
if [ -n "${EXISTING_B64}" ]; then if [ -n "${EXISTING_B64}" ]; then
MAS_PASS="$(printf '%s' "${EXISTING_B64}" | base64 -d)" MAS_PASS="$(printf '%s' "${EXISTING_B64}" | base64 -d)"
if printf '%s' "${MAS_PASS}" | grep -Eq '[^A-Za-z0-9_-]'; then
MAS_PASS="$(safe_pass)"
MAS_B64="$(printf '%s' "${MAS_PASS}" | base64 | tr -d '\n')"
payload="$(printf '{"data":{"password":"%s"}}' "${MAS_B64}")"
kubectl -n comms patch secret mas-db --type=merge -p "${payload}" >/dev/null
fi
else else
MAS_PASS="$(head -c 32 /dev/urandom | base64 | tr -d '\n')" MAS_PASS="$(safe_pass)"
MAS_B64="$(printf '%s' "${MAS_PASS}" | base64 | tr -d '\n')" MAS_B64="$(printf '%s' "${MAS_PASS}" | base64 | tr -d '\n')"
payload="$(printf '{"data":{"password":"%s"}}' "${MAS_B64}")" payload="$(printf '{"data":{"password":"%s"}}' "${MAS_B64}")"
kubectl -n comms patch secret mas-db --type=merge -p "${payload}" >/dev/null kubectl -n comms patch secret mas-db --type=merge -p "${payload}" >/dev/null