64 lines
2.6 KiB
Bash
64 lines
2.6 KiB
Bash
#!/usr/bin/env sh
|
|
# Seed distinct local-only, synthetic, and approved operational credentials.
|
|
set -eu
|
|
umask 077
|
|
secret_path=kv/atlas/hermes/suite-planning-api
|
|
payload_file=/tmp/suite-tokens.json
|
|
trap 'rm -f "$payload_file"' EXIT HUP INT TERM
|
|
attempt=0
|
|
while [ "$attempt" -lt 40 ]; do
|
|
jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
|
|
if VAULT_TOKEN="$(vault write -field=token auth/kubernetes/login role=hermes-suite-token-seed jwt="$jwt" 2>/dev/null)"; then
|
|
unset jwt
|
|
export VAULT_TOKEN
|
|
break
|
|
fi
|
|
unset jwt
|
|
attempt=$((attempt + 1))
|
|
sleep 30
|
|
done
|
|
test "$attempt" -lt 40 || exit 1
|
|
if existing="$(vault kv get -format=json "$secret_path" 2>&1)"; then
|
|
unset existing
|
|
for field in token synthetic_token; do
|
|
value="$(vault kv get -field="$field" "$secret_path" 2>/dev/null)" || exit 1
|
|
case "$value" in ''|*[!0-9a-f]*) exit 1 ;; esac
|
|
test "${#value}" -eq 64 || exit 1
|
|
unset value
|
|
done
|
|
if value="$(vault kv get -field=operational_token "$secret_path" 2>/dev/null)"; then
|
|
case "$value" in ''|*[!0-9a-f]*) exit 1 ;; esac
|
|
test "${#value}" -eq 64 || exit 1
|
|
unset value
|
|
printf 'Suite credentials already present; unchanged.\n'
|
|
exit 0
|
|
fi
|
|
operational_token="$(vault write -field=random_bytes sys/tools/random/32 format=hex)"
|
|
case "$operational_token" in ''|*[!0-9a-f]*) exit 1 ;; esac
|
|
test "${#operational_token}" -eq 64 || exit 1
|
|
printf '{"operational_token":"%s"}\n' "$operational_token" > "$payload_file"
|
|
unset operational_token
|
|
attempt=0
|
|
until vault kv patch -method=patch "$secret_path" @"$payload_file" >/dev/null 2>&1; do
|
|
attempt=$((attempt + 1))
|
|
test "$attempt" -lt 40 || exit 1
|
|
sleep 3
|
|
done
|
|
printf 'Operational credential added; existing credentials unchanged.\n'
|
|
exit 0
|
|
fi
|
|
case "$existing" in *'No value found'*|*'Code: 404'*) ;; *) exit 1 ;; esac
|
|
unset existing
|
|
local_token="$(vault write -field=random_bytes sys/tools/random/32 format=hex)"
|
|
synthetic_token="$(vault write -field=random_bytes sys/tools/random/32 format=hex)"
|
|
operational_token="$(vault write -field=random_bytes sys/tools/random/32 format=hex)"
|
|
for value in "$local_token" "$synthetic_token" "$operational_token"; do
|
|
case "$value" in ''|*[!0-9a-f]*) exit 1 ;; esac
|
|
test "${#value}" -eq 64 || exit 1
|
|
done
|
|
printf '{"options":{"cas":0},"data":{"token":"%s","synthetic_token":"%s","operational_token":"%s"}}\n' \
|
|
"$local_token" "$synthetic_token" "$operational_token" > "$payload_file"
|
|
unset local_token synthetic_token operational_token value
|
|
vault write kv/data/atlas/hermes/suite-planning-api @"$payload_file" >/dev/null 2>&1
|
|
printf 'Suite credentials created.\n'
|