From 461981e4eb565a50fc446b07067ba73ca63888d7 Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Fri, 17 Jul 2026 15:47:13 +0300
Subject: [PATCH] ++ load admin creds: fail fast with diagnostics on empty
 vault reads

---
 scripts/load_admin_creds.sh | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/scripts/load_admin_creds.sh b/scripts/load_admin_creds.sh
index 2976eef..1521b28 100755
--- a/scripts/load_admin_creds.sh
+++ b/scripts/load_admin_creds.sh
@@ -1,9 +1,7 @@
 #!/usr/bin/env sh
 # Read in-cluster infra-service ADMIN creds from the contour Vault and export them
 # for the providers generated in live/terragrunt.hcl. Sourced (not executed) by the
-# CI run steps so the exported vars live in the same shell as terragrunt.
-#
-# Paths are the platform bootstrap layout (same as the bootstrap cronjobs read):
+# CI run steps so exports live in the same shell as terragrunt.
 #   secrets/postgresql/admin  postgres-password
 #   secrets/kafka/bootstrap    interBrokerPassword
 #   secrets/minio/admin        rootUser / rootPassword
@@ -13,12 +11,16 @@ set -eu
 : "${VAULT_TOKEN:?VAULT_TOKEN is required}"
 
 _kv() {
-  curl -sf -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1" \
-    | jq -r --arg k "$2" '.data.data[$k] // ""'
+  # $1=path $2=key -> value on stdout; loud diagnostic to stderr on http error
+  _code=$(curl -s -o /tmp/_kv.json -w '%{http_code}' -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1" || echo 000)
+  if [ "$_code" != "200" ]; then
+    echo "load_admin_creds: cannot read secrets/$1 (http ${_code}) — check VAULT_TOKEN policy and VAULT_ADDR" >&2
+    printf ''
+    return
+  fi
+  jq -r --arg k "$2" '.data.data[$k] // ""' /tmp/_kv.json
 }
 
-# Service endpoints default to the in-cluster svc DNS (consistent across contours);
-# override via CI vars if a contour differs.
 export PG_ADMIN_HOST="${PG_ADMIN_HOST:-postgresql.postgresql.svc.cluster.local}"
 export PG_ADMIN_PORT="${PG_ADMIN_PORT:-5432}"
 export PG_ADMIN_USER="${PG_ADMIN_USER:-postgres}"
@@ -37,4 +39,14 @@ export RABBITMQ_ENDPOINT="${RABBITMQ_ENDPOINT:-http://rabbitmq.rabbitmq.svc.clus
 export RABBITMQ_ADMIN_USER="$(_kv rabbitmq/auth username)"
 export RABBITMQ_ADMIN_PASSWORD="$(_kv rabbitmq/auth password)"
 
+# fail fast with the exact empties instead of leaving providers to give cryptic errors
+_missing=""
+for _v in PG_ADMIN_PASSWORD KAFKA_ADMIN_PASSWORD MINIO_ADMIN_USER MINIO_ADMIN_PASSWORD RABBITMQ_ADMIN_USER RABBITMQ_ADMIN_PASSWORD; do
+  eval "_val=\${$_v}"
+  [ -n "$_val" ] || _missing="$_missing $_v"
+done
+if [ -n "$_missing" ]; then
+  echo "load_admin_creds: EMPTY creds:${_missing} — VAULT_TOKEN cannot read the matching secrets/* paths" >&2
+  exit 1
+fi
 echo "infra admin creds loaded from Vault (${VAULT_ADDR})"