Maidn/maidn-cli
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix: parse uninitialized OpenBao status

Browse source
This commit is contained in:
eding 2026-09-10 23:06:15 +02:00
parent 026b191c84
commit 99eb19fba4
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
internal/openbao/bootstrap.go
View file

@ -268,18 +268,29 @@ func writeSecret(kubeconfig, rootToken, secretPath string, values map[string]str
func waitForPod(kubeconfig string) error {
deadline := time.Now().Add(10 * time.Minute)
var lastErr error
for time.Now().Before(deadline) {
if _, err := getStatus(kubeconfig); err == nil {
return nil
} else {
lastErr = err
}
time.Sleep(2 * time.Second)
}
if lastErr != nil {
return fmt.Errorf("OpenBao pod did not become ready: %w", lastErr)
}
return fmt.Errorf("OpenBao pod did not become ready")
}
func getStatus(kubeconfig string) (status, error) {
command := []string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "openbao-0", "--", "bao", "status", "-format=json"}
output, err := commandOutput(nil, "kubectl", command...)
ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
defer cancel()
output, err := exec.CommandContext(ctx, "kubectl", command...).Output()
if errors.Is(ctx.Err(), context.DeadlineExceeded) {
return status{}, fmt.Errorf("get OpenBao status timed out after %s", commandTimeout)
}
if err != nil && !json.Valid(output) {
return status{}, fmt.Errorf("get OpenBao status: %w", err)
}
@ -333,7 +344,7 @@ read -r reviewer_token
export BAO_TOKEN="$root_token"
bao secrets enable -path=secret kv-v2 >/dev/null 2>&1 || true
bao auth enable kubernetes >/dev/null 2>&1 || true
bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null 2>&1 || fail kubernetes-auth-config
bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null || fail kubernetes-auth-config
cat >/tmp/external-secrets.hcl <<'EOF'
path "secret/data/platform/*" {
capabilities = ["read"]