69 lines
2.1 KiB
Bash
Executable File
69 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Minimal Vault helper for CI steps (AppRole login + KVv2 reads).
|
|
# Requires: curl, sed. Uses VAULT_ADDR, VAULT_ROLE_ID, VAULT_SECRET_ID from env.
|
|
set -euo pipefail
|
|
|
|
: "${VAULT_ADDR:?missing VAULT_ADDR}"
|
|
VAULT_TOKEN_FILE="${VAULT_TOKEN_FILE:-.vault_token}"
|
|
|
|
log(){ printf '[vlt] %s\n' "$*" >&2; }
|
|
|
|
login() {
|
|
: "${VAULT_ROLE_ID:?missing VAULT_ROLE_ID}"
|
|
: "${VAULT_SECRET_ID:?missing VAULT_SECRET_ID}"
|
|
log "login approle"
|
|
resp="$(curl -sfS -X POST -H 'Content-Type: application/json' \
|
|
--connect-timeout 5 --max-time 20 \
|
|
-d "{\"role_id\":\"${VAULT_ROLE_ID}\",\"secret_id\":\"${VAULT_SECRET_ID}\"}" \
|
|
"${VAULT_ADDR%/}/v1/auth/approle/login")"
|
|
token="$(printf '%s' "$resp" | sed -n 's/.*"client_token"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
|
|
[ -n "$token" ] || { echo "login failed" >&2; exit 1; }
|
|
printf '%s' "$token" > "$VAULT_TOKEN_FILE"
|
|
}
|
|
|
|
ensure_token() {
|
|
if [ -s "$VAULT_TOKEN_FILE" ]; then
|
|
VAULT_TOKEN="$(cat "$VAULT_TOKEN_FILE")"
|
|
else
|
|
login
|
|
VAULT_TOKEN="$(cat "$VAULT_TOKEN_FILE")"
|
|
fi
|
|
}
|
|
|
|
# kv_get <mount> <path> <field> (KV v2)
|
|
kv_get() {
|
|
mount="$1"; path="$2"; field="$3"
|
|
ensure_token
|
|
url="${VAULT_ADDR%/}/v1/${mount}/data/${path}"
|
|
resp="$(curl -sfS --connect-timeout 5 --max-time 20 -H "X-Vault-Token: ${VAULT_TOKEN}" "$url")"
|
|
RESP="$resp" python3 - "$field" <<'PY'
|
|
import json, os, sys
|
|
field = sys.argv[1]
|
|
resp = os.environ.get("RESP", "")
|
|
try:
|
|
data = json.loads(resp)
|
|
value = data["data"]["data"][field]
|
|
except (KeyError, TypeError, json.JSONDecodeError):
|
|
print(f"field not found or invalid JSON", file=sys.stderr)
|
|
sys.exit(2)
|
|
sys.stdout.write(value)
|
|
PY
|
|
}
|
|
|
|
# kv_to_file <mount> <path> <field> <dest> [mode]
|
|
kv_to_file() {
|
|
mount="$1"; path="$2"; field="$3"; dest="$4"; mode="${5:-600}"
|
|
tmp="$(mktemp)"
|
|
kv_get "$mount" "$path" "$field" > "$tmp"
|
|
install -m "$mode" "$tmp" "$dest"
|
|
rm -f "$tmp"
|
|
log "wrote $dest"
|
|
}
|
|
|
|
case "${1:-}" in
|
|
login) shift; login "$@";;
|
|
kv_get) shift; kv_get "$@";;
|
|
kv_to_file) shift; kv_to_file "$@";;
|
|
*) echo "usage: vlt {login|kv_get|kv_to_file} ..." >&2; exit 64;;
|
|
esac
|