Maidn/maidn-cli
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix: bound OpenBao bootstrap commands

Browse source
This commit is contained in:
eding 2026-09-08 16:57:30 +02:00
parent b55602ce23
commit f5015c67c0
1 changed files with 19 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
internal/openbao/bootstrap.go
View file

@ -2,6 +2,7 @@ package openbao
import ( import (
"bytes" "bytes"
"context"
"encoding/base64" "encoding/base64"
"encoding/json" "encoding/json"
"errors" "errors"
@ -45,6 +46,8 @@ var decryptRecovery = func(identityPath, bundlePath string) ([]byte, error) {
var openBaoStatus = getStatus var openBaoStatus = getStatus
var commandTimeout = time.Minute
func EnsureRecoveryIdentity(identityPath string) (string, error) { func EnsureRecoveryIdentity(identityPath string) (string, error) {
if _, err := os.Stat(identityPath); os.IsNotExist(err) { if _, err := os.Stat(identityPath); os.IsNotExist(err) {
if err := os.MkdirAll(filepath.Dir(identityPath), 0700); err != nil { if err := os.MkdirAll(filepath.Dir(identityPath), 0700); err != nil {
@ -251,7 +254,7 @@ func waitForPod(kubeconfig string) error {
func getStatus(kubeconfig string) (status, error) { func getStatus(kubeconfig string) (status, error) {
command := []string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "openbao-0", "--", "bao", "status", "-format=json"} command := []string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "openbao-0", "--", "bao", "status", "-format=json"}
output, err := exec.Command("kubectl", command...).Output() output, err := commandOutput(nil, "kubectl", command...)
if err != nil && !json.Valid(output) { if err != nil && !json.Valid(output) {
return status{}, fmt.Errorf("get OpenBao status: %w", err) return status{}, fmt.Errorf("get OpenBao status: %w", err)
} }
@ -411,17 +414,27 @@ func encryptRecovery(recipient, bundlePath string, plaintext []byte) error {
var execInPod = func(kubeconfig string, input []byte, args ...string) ([]byte, error) { var execInPod = func(kubeconfig string, input []byte, args ...string) ([]byte, error) {
command := append([]string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "-i", "openbao-0", "--"}, args...) command := append([]string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "-i", "openbao-0", "--"}, args...)
cmd := exec.Command("kubectl", command...) return commandOutput(input, "kubectl", command...)
cmd.Stdin = bytes.NewReader(input)
return cmd.CombinedOutput()
} }
var execInUnsealController = func(kubeconfig, script string) ([]byte, error) { var execInUnsealController = func(kubeconfig, script string) ([]byte, error) {
command := []string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "deployment/openbao-unseal", "--", "sh", "-ec", script} command := []string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "deployment/openbao-unseal", "--", "sh", "-ec", script}
return exec.Command("kubectl", command...).CombinedOutput() return commandOutput(nil, "kubectl", command...)
} }
var kubectlOutput = func(kubeconfig string, args ...string) ([]byte, error) { var kubectlOutput = func(kubeconfig string, args ...string) ([]byte, error) {
command := append([]string{"--kubeconfig", kubeconfig}, args...) command := append([]string{"--kubeconfig", kubeconfig}, args...)
return exec.Command("kubectl", command...).Output() return commandOutput(nil, "kubectl", command...)
}
func commandOutput(input []byte, name string, args ...string) ([]byte, error) {
ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
defer cancel()
cmd := exec.CommandContext(ctx, name, args...)
cmd.Stdin = bytes.NewReader(input)
output, err := cmd.CombinedOutput()
if errors.Is(ctx.Err(), context.DeadlineExceeded) {
return output, fmt.Errorf("%s timed out after %s", name, commandTimeout)
}
return output, err
} }