Maidn/maidn-cli
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'fix: report OpenBao auth setup stage' (#34) from fix/openbao-auth-diagnostics into main

Browse source 
Reviewed-on: #34
This commit is contained in:
eding 2026-09-08 16:46:13 +02:00
parent 461e4a02ab 888f4aa88b
commit b55602ce23
1 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
internal/openbao/bootstrap.go
View file

@ -299,12 +299,13 @@ done`
} }
func configureKubernetesAuth(kubeconfig, rootToken, reviewerToken string) error { func configureKubernetesAuth(kubeconfig, rootToken, reviewerToken string) error {
const script = `read -r root_token const script = `fail() { printf '%s\n' "$1" >&2; exit 1; }
read -r root_token
read -r reviewer_token read -r reviewer_token
export BAO_TOKEN="$root_token" export BAO_TOKEN="$root_token"
bao secrets enable -path=secret kv-v2 >/dev/null 2>&1 || true bao secrets enable -path=secret kv-v2 >/dev/null 2>&1 || true
bao auth enable kubernetes >/dev/null 2>&1 || true bao auth enable kubernetes >/dev/null 2>&1 || true
bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null 2>&1 || fail kubernetes-auth-config
cat >/tmp/external-secrets.hcl <<'EOF' cat >/tmp/external-secrets.hcl <<'EOF'
path "secret/data/platform/*" { path "secret/data/platform/*" {
capabilities = ["read"] capabilities = ["read"]
@ -319,12 +320,15 @@ path "secret/metadata/cicd/*" {
capabilities = ["list", "read"] capabilities = ["list", "read"]
} }
EOF EOF
bao policy write external-secrets /tmp/external-secrets.hcl >/dev/null bao policy write external-secrets /tmp/external-secrets.hcl >/dev/null 2>&1 || fail platform-external-secrets-policy
rm -f /tmp/external-secrets.hcl rm -f /tmp/external-secrets.hcl
bao write auth/kubernetes/role/external-secrets bound_service_account_names=external-secrets bound_service_account_namespaces=external-secrets policies=external-secrets ttl=1h >/dev/null` bao write auth/kubernetes/role/external-secrets bound_service_account_names=external-secrets bound_service_account_namespaces=external-secrets policies=external-secrets ttl=1h >/dev/null 2>&1 || fail platform-external-secrets-role`
input := []byte(rootToken + "\n" + reviewerToken + "\n") input := []byte(rootToken + "\n" + reviewerToken + "\n")
_, err := execInPod(kubeconfig, input, "sh", "-ec", script) output, err := execInPod(kubeconfig, input, "sh", "-ec", script)
return err if err != nil {
return fmt.Errorf("configure Kubernetes auth: %w: %s", err, strings.TrimSpace(string(output)))
}
return nil
} }
// ConfigureSecretGrants creates only OpenBao policies and Kubernetes auth // ConfigureSecretGrants creates only OpenBao policies and Kubernetes auth