sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-08-05 18:31:00 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

++ load admin creds: fail fast with diagnostics on empty vault reads

Browse Source
This commit is contained in:
Kochetkov S 2026-07-17 15:47:13 +03:00
parent efcfb1e2f3
commit 461981e4eb
1 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
scripts/load_admin_creds.sh
View File

@ -1,9 +1,7 @@
#!/usr/bin/env sh #!/usr/bin/env sh
# Read in-cluster infra-service ADMIN creds from the contour Vault and export them # Read in-cluster infra-service ADMIN creds from the contour Vault and export them
# for the providers generated in live/terragrunt.hcl. Sourced (not executed) by the # for the providers generated in live/terragrunt.hcl. Sourced (not executed) by the
# CI run steps so the exported vars live in the same shell as terragrunt. # CI run steps so exports live in the same shell as terragrunt.
#
# Paths are the platform bootstrap layout (same as the bootstrap cronjobs read):
# secrets/postgresql/admin postgres-password # secrets/postgresql/admin postgres-password
# secrets/kafka/bootstrap interBrokerPassword # secrets/kafka/bootstrap interBrokerPassword
# secrets/minio/admin rootUser / rootPassword # secrets/minio/admin rootUser / rootPassword
@ -13,12 +11,16 @@ set -eu
: "${VAULT_TOKEN:?VAULT_TOKEN is required}" : "${VAULT_TOKEN:?VAULT_TOKEN is required}"
_kv() { _kv() {
curl -sf -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1" \ # $1=path $2=key -> value on stdout; loud diagnostic to stderr on http error
| jq -r --arg k "$2" '.data.data[$k] // ""' _code=$(curl -s -o /tmp/_kv.json -w '%{http_code}' -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1" || echo 000)
if [ "$_code" != "200" ]; then
echo "load_admin_creds: cannot read secrets/$1 (http ${_code}) — check VAULT_TOKEN policy and VAULT_ADDR" >&2
printf ''
return
fi
jq -r --arg k "$2" '.data.data[$k] // ""' /tmp/_kv.json
} }
# Service endpoints default to the in-cluster svc DNS (consistent across contours);
# override via CI vars if a contour differs.
export PG_ADMIN_HOST="${PG_ADMIN_HOST:-postgresql.postgresql.svc.cluster.local}" export PG_ADMIN_HOST="${PG_ADMIN_HOST:-postgresql.postgresql.svc.cluster.local}"
export PG_ADMIN_PORT="${PG_ADMIN_PORT:-5432}" export PG_ADMIN_PORT="${PG_ADMIN_PORT:-5432}"
export PG_ADMIN_USER="${PG_ADMIN_USER:-postgres}" export PG_ADMIN_USER="${PG_ADMIN_USER:-postgres}"
@ -37,4 +39,14 @@ export RABBITMQ_ENDPOINT="${RABBITMQ_ENDPOINT:-http://rabbitmq.rabbitmq.svc.clus
export RABBITMQ_ADMIN_USER="$(_kv rabbitmq/auth username)" export RABBITMQ_ADMIN_USER="$(_kv rabbitmq/auth username)"
export RABBITMQ_ADMIN_PASSWORD="$(_kv rabbitmq/auth password)" export RABBITMQ_ADMIN_PASSWORD="$(_kv rabbitmq/auth password)"
# fail fast with the exact empties instead of leaving providers to give cryptic errors
_missing=""
for _v in PG_ADMIN_PASSWORD KAFKA_ADMIN_PASSWORD MINIO_ADMIN_USER MINIO_ADMIN_PASSWORD RABBITMQ_ADMIN_USER RABBITMQ_ADMIN_PASSWORD; do
eval "_val=\${$_v}"
[ -n "$_val" ] || _missing="$_missing $_v"
done
if [ -n "$_missing" ]; then
echo "load_admin_creds: EMPTY creds:${_missing} — VAULT_TOKEN cannot read the matching secrets/* paths" >&2
exit 1
fi
echo "infra admin creds loaded from Vault (${VAULT_ADDR})" echo "infra admin creds loaded from Vault (${VAULT_ADDR})"