Maidn/maidn-cli
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix: parse uninitialized OpenBao status #40

Merged
eding merged 1 commit from fix/openbao-status-readiness into main 2026-09-10 23:07:40 +02:00
Conversation 0 Commits 1 Files changed 1 +13 -2
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
internal/openbao/bootstrap.go
View file

@ -268,18 +268,29 @@ func writeSecret(kubeconfig, rootToken, secretPath string, values map[string]str
func waitForPod(kubeconfig string) error { func waitForPod(kubeconfig string) error {
deadline := time.Now().Add(10 * time.Minute) deadline := time.Now().Add(10 * time.Minute)
var lastErr error
for time.Now().Before(deadline) { for time.Now().Before(deadline) {
if _, err := getStatus(kubeconfig); err == nil { if _, err := getStatus(kubeconfig); err == nil {
return nil return nil
} else {
lastErr = err
} }
time.Sleep(2 * time.Second) time.Sleep(2 * time.Second)
} }
if lastErr != nil {
return fmt.Errorf("OpenBao pod did not become ready: %w", lastErr)
}
return fmt.Errorf("OpenBao pod did not become ready") return fmt.Errorf("OpenBao pod did not become ready")
} }
func getStatus(kubeconfig string) (status, error) { func getStatus(kubeconfig string) (status, error) {
command := []string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "openbao-0", "--", "bao", "status", "-format=json"} command := []string{"--kubeconfig", kubeconfig, "-n", "openbao", "exec", "openbao-0", "--", "bao", "status", "-format=json"}
output, err := commandOutput(nil, "kubectl", command...) ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
defer cancel()
output, err := exec.CommandContext(ctx, "kubectl", command...).Output()
if errors.Is(ctx.Err(), context.DeadlineExceeded) {
return status{}, fmt.Errorf("get OpenBao status timed out after %s", commandTimeout)
}
if err != nil && !json.Valid(output) { if err != nil && !json.Valid(output) {
return status{}, fmt.Errorf("get OpenBao status: %w", err) return status{}, fmt.Errorf("get OpenBao status: %w", err)
} }
@ -333,7 +344,7 @@ read -r reviewer_token
export BAO_TOKEN="$root_token" export BAO_TOKEN="$root_token"
bao secrets enable -path=secret kv-v2 >/dev/null 2>&1 || true bao secrets enable -path=secret kv-v2 >/dev/null 2>&1 || true
bao auth enable kubernetes >/dev/null 2>&1 || true bao auth enable kubernetes >/dev/null 2>&1 || true
bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null 2>&1 || fail kubernetes-auth-config bao write auth/kubernetes/config token_reviewer_jwt="$reviewer_token" kubernetes_host="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt >/dev/null || fail kubernetes-auth-config
cat >/tmp/external-secrets.hcl <<'EOF' cat >/tmp/external-secrets.hcl <<'EOF'
path "secret/data/platform/*" { path "secret/data/platform/*" {
capabilities = ["read"] capabilities = ["read"]