coulomb/net-kingdom
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix OpenBao rotation commands

Browse Source
This commit is contained in:
Bernd Worsch
2026-05-25 23:56:55 +02:00
parent d39dbe14b8
commit 8520ae8d7d
2 changed files with 43 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
tools/security-bootstrap-console/security_bootstrap_console.py
View File

@@ -1466,6 +1466,29 @@ def runbook_command_payloads(data: dict[str, Any]) -> list[dict[str, str]]:
"unset OPENBAO_TOKEN"
)
def interactive_token_command(bao_command: str, prompt_nonce: bool = False) -> str:
nonce_prompt = (
' printf "Rotation nonce: " >&2\n'
' read -r ROTATION_NONCE\n'
if prompt_nonce
else ""
)
return (
"kubectl exec -it -n openbao openbao-0 -- sh -lc '\n"
" restore_tty() { stty echo 2>/dev/null || true; }\n"
" trap restore_tty EXIT INT TERM\n"
f"{nonce_prompt}"
" printf \"OpenBao token: \" >&2\n"
" stty -echo\n"
" read -r BAO_TOKEN\n"
" stty echo\n"
" printf \"\\n\" >&2\n"
" export BAO_TOKEN\n"
f" {bao_command}\n"
" unset BAO_TOKEN\n"
"'"
)
def action(name: str, description: str, command: str, taint: dict[str, str] | None = None) -> dict[str, str]:
return add_taint(
{
@@ -1480,6 +1503,14 @@ def runbook_command_payloads(data: dict[str, Any]) -> list[dict[str, str]]:
audit_list_command = token_prompt_command("bao audit list")
secrets_list_command = token_prompt_command("bao secrets list")
auth_list_command = token_prompt_command("bao auth list")
rotate_init_command = interactive_token_command(
"bao operator rotate-keys -init -key-shares=3 -key-threshold=2"
)
rotate_submit_command = interactive_token_command(
'bao operator rotate-keys -nonce="$ROTATION_NONCE"',
prompt_nonce=True,
)
rotate_cancel_command = interactive_token_command("bao operator rotate-keys -cancel")
openbao_status_command = "kubectl exec -n openbao openbao-0 -- bao status"
direct_taint = openbao_direct_taint if initialized else {}
downstream_taint = openbao_downstream_taint if initialized else {}
@@ -1562,20 +1593,20 @@ def runbook_command_payloads(data: dict[str, Any]) -> list[dict[str, str]]:
),
action(
"Start unseal-key rotation",
"Generate a new 3-share, threshold-2 Shamir split after compromise or planned migration.",
"kubectl exec -it -n openbao openbao-0 -- bao operator rotate-keys -init -key-shares=3 -key-threshold=2",
"Generate a new 3-share, threshold-2 Shamir split. Requires an OpenBao token with root or sudo capability.",
rotate_init_command,
compromise_taint,
),
action(
"Submit current shares for rotation",
"Repeat by prompt until the required threshold completes. Use the nonce from rotation init.",
"kubectl exec -it -n openbao openbao-0 -- bao operator rotate-keys -nonce=<nonce-from-rotation-init>",
"Repeat by prompt until the required threshold completes. Enter the nonce from rotation init, then the token and share prompts.",
rotate_submit_command,
compromise_taint,
),
action(
"Cancel key rotation",
"Abort a started rotation if the nonce, share handling, or ceremony context is wrong.",
"kubectl exec -it -n openbao openbao-0 -- bao operator rotate-keys -cancel",
"Abort a started rotation if the nonce, share handling, or ceremony context is wrong. Requires a root/sudo-capable token.",
rotate_cancel_command,
compromise_taint,
),
action(