From 888f4aa88b23bface55e4d9f9061e652dcb91047 Mon Sep 17 00:00:00 2001
From: Maidn <maidn@free-maidn.com>
Date: Tue, 8 Sep 2026 16:42:30 +0200
Subject: [PATCH] fix: report OpenBao auth setup stage

---
 internal/openbao/bootstrap.go | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/internal/openbao/bootstrap.go b/internal/openbao/bootstrap.go
index f60d5cf..108e863 100644
--- a/internal/openbao/bootstrap.go
+++ b/internal/openbao/bootstrap.go
@@ -299,12 +299,13 @@ done`
 }
 
 func configureKubernetesAuth(kubeconfig, rootToken, reviewerToken string) error {
-	const script = `read -r root_token
+	const script = `fail() { printf '%s\n' "$1" >&2; exit 1; }
+read -r root_token
 read -r reviewer_token
 export BAO_TOKEN="$root_token"
 bao secrets enable -path=secret kv-v2 >/dev/null 2>&1 || true
 bao auth enable kubernetes >/dev/null 2>&1 || true
-bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null
+bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null 2>&1 || fail kubernetes-auth-config
 cat >/tmp/external-secrets.hcl <<'EOF'
 	path "secret/data/platform/*" {
 	  capabilities = ["read"]
@@ -319,12 +320,15 @@ path "secret/metadata/cicd/*" {
 	  capabilities = ["list", "read"]
 }
 EOF
-bao policy write external-secrets /tmp/external-secrets.hcl >/dev/null
+bao policy write external-secrets /tmp/external-secrets.hcl >/dev/null 2>&1 || fail platform-external-secrets-policy
 rm -f /tmp/external-secrets.hcl
-bao write auth/kubernetes/role/external-secrets bound_service_account_names=external-secrets bound_service_account_namespaces=external-secrets policies=external-secrets ttl=1h >/dev/null`
+bao write auth/kubernetes/role/external-secrets bound_service_account_names=external-secrets bound_service_account_namespaces=external-secrets policies=external-secrets ttl=1h >/dev/null 2>&1 || fail platform-external-secrets-role`
 	input := []byte(rootToken + "\n" + reviewerToken + "\n")
-	_, err := execInPod(kubeconfig, input, "sh", "-ec", script)
-	return err
+	output, err := execInPod(kubeconfig, input, "sh", "-ec", script)
+	if err != nil {
+		return fmt.Errorf("configure Kubernetes auth: %w: %s", err, strings.TrimSpace(string(output)))
+	}
+	return nil
 }
 
 // ConfigureSecretGrants creates only OpenBao policies and Kubernetes auth
-- 
2.43.7