mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
66 lines
3.1 KiB
Bash
Executable File
66 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env sh
|
|
# Read in-cluster infra-service ADMIN creds from the contour Vault and export them
|
|
# for the providers generated in live/terragrunt.hcl. Sourced (not executed) by the
|
|
# CI run steps so exports live in the same shell as terragrunt.
|
|
# secrets/postgresql/admin postgres-password
|
|
# secrets/kafka/bootstrap interBrokerPassword
|
|
# secrets/minio/admin rootUser / rootPassword
|
|
# secrets/rabbitmq/auth username / password
|
|
set -eu
|
|
: "${VAULT_ADDR:?VAULT_ADDR is required}"
|
|
: "${VAULT_TOKEN:?VAULT_TOKEN is required}"
|
|
|
|
_kv() {
|
|
# $1=path $2=key -> value on stdout; loud diagnostic to stderr on http error
|
|
_code=$(curl -s -o /tmp/_kv.json -w '%{http_code}' -H "X-Vault-Token: ${VAULT_TOKEN}" "${VAULT_ADDR}/v1/secrets/data/$1") || true
|
|
if [ "$_code" != "200" ]; then
|
|
echo "load_admin_creds: cannot read secrets/$1 (http ${_code}) — check VAULT_TOKEN policy and VAULT_ADDR" >&2
|
|
printf ''
|
|
return
|
|
fi
|
|
jq -r --arg k "$2" '.data.data[$k] // ""' /tmp/_kv.json
|
|
}
|
|
|
|
# SKIP_POSTGRES_ADMIN/SKIP_KAFKA_ADMIN/SKIP_MINIO_ADMIN=true on contours with
|
|
# no in-cluster instance of that backend (nothing to read, nothing declared)
|
|
# — set as a CI var on that contour's repo.
|
|
if [ "${SKIP_POSTGRES_ADMIN:-false}" != "true" ]; then
|
|
export PG_ADMIN_HOST="${PG_ADMIN_HOST:-postgresql.postgresql.svc.cluster.local}"
|
|
export PG_ADMIN_PORT="${PG_ADMIN_PORT:-5432}"
|
|
export PG_ADMIN_USER="${PG_ADMIN_USER:-postgres}"
|
|
export PG_ADMIN_PASSWORD="$(_kv postgresql/admin postgres-password)"
|
|
fi
|
|
|
|
if [ "${SKIP_KAFKA_ADMIN:-false}" != "true" ]; then
|
|
export KAFKA_BOOTSTRAP="${KAFKA_BOOTSTRAP:-kafka-kafka-contour-controller-0.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094}"
|
|
export KAFKA_ADMIN_USER="${KAFKA_ADMIN_USER:-inter_broker_user}"
|
|
export KAFKA_ADMIN_PASSWORD="$(_kv kafka/bootstrap interBrokerPassword)"
|
|
export KAFKA_SASL_MECHANISM="${KAFKA_SASL_MECHANISM:-plain}"
|
|
fi
|
|
|
|
if [ "${SKIP_MINIO_ADMIN:-false}" != "true" ]; then
|
|
export MINIO_ENDPOINT="${MINIO_ENDPOINT:-minio.minio.svc.cluster.local:9000}"
|
|
export MINIO_ADMIN_USER="$(_kv minio/admin rootUser)"
|
|
export MINIO_ADMIN_PASSWORD="$(_kv minio/admin rootPassword)"
|
|
fi
|
|
|
|
export RABBITMQ_ENDPOINT="${RABBITMQ_ENDPOINT:-http://rabbitmq.rabbitmq.svc.cluster.local:15672}"
|
|
export RABBITMQ_ADMIN_USER="$(_kv rabbitmq/auth username)"
|
|
export RABBITMQ_ADMIN_PASSWORD="$(_kv rabbitmq/auth password)"
|
|
|
|
# fail fast with the exact empties instead of leaving providers to give cryptic errors
|
|
_missing=""
|
|
_required="RABBITMQ_ADMIN_USER RABBITMQ_ADMIN_PASSWORD"
|
|
[ "${SKIP_POSTGRES_ADMIN:-false}" != "true" ] && _required="$_required PG_ADMIN_PASSWORD"
|
|
[ "${SKIP_KAFKA_ADMIN:-false}" != "true" ] && _required="$_required KAFKA_ADMIN_PASSWORD"
|
|
[ "${SKIP_MINIO_ADMIN:-false}" != "true" ] && _required="$_required MINIO_ADMIN_USER MINIO_ADMIN_PASSWORD"
|
|
for _v in $_required; do
|
|
eval "_val=\${$_v}"
|
|
[ -n "$_val" ] || _missing="$_missing $_v"
|
|
done
|
|
if [ -n "$_missing" ]; then
|
|
echo "load_admin_creds: EMPTY creds:${_missing} — VAULT_TOKEN cannot read the matching secrets/* paths" >&2
|
|
exit 1
|
|
fi
|
|
echo "infra admin creds loaded from Vault (${VAULT_ADDR})"
|