mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-06 02:31:35 +03:00
41 lines
1.9 KiB
Bash
Executable File
41 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
# Read in-cluster infra-service ADMIN creds from the contour Vault and export them
|
|
# for the providers generated in live/terragrunt.hcl. Sourced (not executed) by the
|
|
# CI run steps so the exported vars live in the same shell as terragrunt.
|
|
#
|
|
# Paths are the platform bootstrap layout (same as the bootstrap cronjobs read):
|
|
# secrets/postgresql/admin postgres-password
|
|
# secrets/kafka/bootstrap interBrokerPassword
|
|
# secrets/minio/admin rootUser / rootPassword
|
|
# secrets/rabbitmq/auth username / password
|
|
set -eu
|
|
: "${VAULT_ADDR:?VAULT_ADDR is required}"
|
|
: "${VAULT_TOKEN:?VAULT_TOKEN is required}"
|
|
|
|
_kv() {
|
|
curl -sf -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1" \
|
|
| jq -r --arg k "$2" '.data.data[$k] // ""'
|
|
}
|
|
|
|
# Service endpoints default to the in-cluster svc DNS (consistent across contours);
|
|
# override via CI vars if a contour differs.
|
|
export PG_ADMIN_HOST="${PG_ADMIN_HOST:-postgresql.postgresql.svc.cluster.local}"
|
|
export PG_ADMIN_PORT="${PG_ADMIN_PORT:-5432}"
|
|
export PG_ADMIN_USER="${PG_ADMIN_USER:-postgres}"
|
|
export PG_ADMIN_PASSWORD="$(_kv postgresql/admin postgres-password)"
|
|
|
|
export KAFKA_BOOTSTRAP="${KAFKA_BOOTSTRAP:-kafka-kafka-contour.kafka.svc.cluster.local:9092}"
|
|
export KAFKA_ADMIN_USER="${KAFKA_ADMIN_USER:-inter_broker_user}"
|
|
export KAFKA_ADMIN_PASSWORD="$(_kv kafka/bootstrap interBrokerPassword)"
|
|
export KAFKA_SASL_MECHANISM="${KAFKA_SASL_MECHANISM:-plain}"
|
|
|
|
export MINIO_ENDPOINT="${MINIO_ENDPOINT:-minio.minio.svc.cluster.local:9000}"
|
|
export MINIO_ADMIN_USER="$(_kv minio/admin rootUser)"
|
|
export MINIO_ADMIN_PASSWORD="$(_kv minio/admin rootPassword)"
|
|
|
|
export RABBITMQ_ENDPOINT="${RABBITMQ_ENDPOINT:-http://rabbitmq.rabbitmq.svc.cluster.local:15672}"
|
|
export RABBITMQ_ADMIN_USER="$(_kv rabbitmq/auth username)"
|
|
export RABBITMQ_ADMIN_PASSWORD="$(_kv rabbitmq/auth password)"
|
|
|
|
echo "infra admin creds loaded from Vault (${VAULT_ADDR})"
|