internal/openbao/bootstrap.go

@@ -299,13 +299,12 @@ done`
 }
 
 func configureKubernetesAuth(kubeconfig, rootToken, reviewerToken string) error {
-	const script = `fail() { printf '%s\n' "$1" >&2; exit 1; }
+	const script = `read -r root_token
-read -r root_token
 read -r reviewer_token
 export BAO_TOKEN="$root_token"
 bao secrets enable -path=secret kv-v2 >/dev/null 2>&1 || true
 bao auth enable kubernetes >/dev/null 2>&1 || true
-bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null 2>&1 || fail kubernetes-auth-config
+bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null
 cat >/tmp/external-secrets.hcl <<'EOF'
 	path "secret/data/platform/*" {
 	  capabilities = ["read"]
@@ -320,15 +319,12 @@ path "secret/metadata/cicd/*" {
 	  capabilities = ["list", "read"]
 }
 EOF
-bao policy write external-secrets /tmp/external-secrets.hcl >/dev/null 2>&1 || fail platform-external-secrets-policy
+bao policy write external-secrets /tmp/external-secrets.hcl >/dev/null
 rm -f /tmp/external-secrets.hcl
-bao write auth/kubernetes/role/external-secrets bound_service_account_names=external-secrets bound_service_account_namespaces=external-secrets policies=external-secrets ttl=1h >/dev/null 2>&1 || fail platform-external-secrets-role`
+bao write auth/kubernetes/role/external-secrets bound_service_account_names=external-secrets bound_service_account_namespaces=external-secrets policies=external-secrets ttl=1h >/dev/null`
 	input := []byte(rootToken + "\n" + reviewerToken + "\n")
-	output, err := execInPod(kubeconfig, input, "sh", "-ec", script)
+	_, err := execInPod(kubeconfig, input, "sh", "-ec", script)
-	if err != nil {
+	return err
-		return fmt.Errorf("configure Kubernetes auth: %w: %s", err, strings.TrimSpace(string(output)))
-	}
-	return nil
 }
 
 // ConfigureSecretGrants creates only OpenBao policies and Kubernetes auth