138 lines
3.8 KiB
Bash
Executable File
138 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
OPENBAO_NAMESPACE="${OPENBAO_NAMESPACE:-openbao}"
|
|
OPENBAO_RELEASE="${OPENBAO_RELEASE:-openbao}"
|
|
KUBECTL="${KUBECTL:-kubectl}"
|
|
TOKEN_FILE="${OPENBAO_TOKEN_FILE:-}"
|
|
REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
POLICY_NAME="${WORKLOAD_KV_POLICY_NAME:-workload-kv-read-whynot-design-npm-publish}"
|
|
POLICY_FILE="${WORKLOAD_KV_POLICY_FILE:-$REPO_DIR/openbao/policies/workload-kv-read-whynot-design-npm-publish.hcl}"
|
|
DRY_RUN=0
|
|
USE_TOKEN_HELPER=0
|
|
|
|
usage() {
|
|
cat <<'USAGE'
|
|
Usage: scripts/openbao-apply-workload-kv-lanes.sh [--dry-run] [--use-token-helper]
|
|
|
|
Applies source-owned OpenBao workload KV read-lane policies.
|
|
|
|
Current lane:
|
|
- policy: workload-kv-read-whynot-design-npm-publish
|
|
- path: platform/workloads/whynot-design/whynot-design/npm-publish
|
|
- field: NPM_AUTH_TOKEN
|
|
|
|
The script reads an OpenBao operator token from OPENBAO_TOKEN_FILE or an
|
|
interactive hidden prompt unless --dry-run or --use-token-helper is set. It
|
|
never prints or stores the token.
|
|
|
|
This script intentionally does not create an OIDC role until the whynot-design
|
|
KeyCape/NetKingdom bound claim is confirmed.
|
|
USAGE
|
|
}
|
|
|
|
while [ "$#" -gt 0 ]; do
|
|
case "$1" in
|
|
--dry-run)
|
|
DRY_RUN=1
|
|
shift
|
|
;;
|
|
--use-token-helper)
|
|
USE_TOKEN_HELPER=1
|
|
shift
|
|
;;
|
|
-h|--help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "ERROR: unknown argument: $1" >&2
|
|
usage >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
done
|
|
|
|
pod="${OPENBAO_RELEASE}-0"
|
|
|
|
read_token() {
|
|
if [ "$DRY_RUN" -eq 1 ] || [ "$USE_TOKEN_HELPER" -eq 1 ]; then
|
|
return
|
|
fi
|
|
if [ -n "$TOKEN_FILE" ]; then
|
|
if [ ! -f "$TOKEN_FILE" ]; then
|
|
echo "ERROR: OPENBAO_TOKEN_FILE does not exist: $TOKEN_FILE" >&2
|
|
exit 1
|
|
fi
|
|
head -n 1 "$TOKEN_FILE"
|
|
return
|
|
fi
|
|
|
|
local token
|
|
read -r -s -p "OpenBao token: " token
|
|
printf '\n' >&2
|
|
printf '%s\n' "$token"
|
|
}
|
|
|
|
remote_bao() {
|
|
local token="$1"
|
|
shift
|
|
if [ "$DRY_RUN" -eq 1 ]; then
|
|
printf 'DRY-RUN: bao %s\n' "$*"
|
|
return 0
|
|
fi
|
|
if [ "$USE_TOKEN_HELPER" -eq 1 ]; then
|
|
# shellcheck disable=SC2086
|
|
$KUBECTL exec -i -n "$OPENBAO_NAMESPACE" "$pod" -- bao "$@"
|
|
return
|
|
fi
|
|
# shellcheck disable=SC2086
|
|
printf '%s\n' "$token" | $KUBECTL exec -i -n "$OPENBAO_NAMESPACE" "$pod" -- \
|
|
sh -c 'read -r BAO_TOKEN; export BAO_TOKEN; exec bao "$@"' sh "$@"
|
|
}
|
|
|
|
write_policy() {
|
|
local token="$1"
|
|
if [ ! -f "$POLICY_FILE" ]; then
|
|
echo "ERROR: missing policy file: $POLICY_FILE" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$DRY_RUN" -eq 1 ]; then
|
|
printf 'DRY-RUN: bao policy write %s %s\n' "$POLICY_NAME" "$POLICY_FILE"
|
|
return 0
|
|
fi
|
|
if [ "$USE_TOKEN_HELPER" -eq 1 ]; then
|
|
# shellcheck disable=SC2086
|
|
cat "$POLICY_FILE" | $KUBECTL exec -i -n "$OPENBAO_NAMESPACE" "$pod" -- \
|
|
bao policy write "$POLICY_NAME" -
|
|
return
|
|
fi
|
|
# shellcheck disable=SC2086
|
|
{ printf '%s\n' "$token"; cat "$POLICY_FILE"; } | \
|
|
$KUBECTL exec -i -n "$OPENBAO_NAMESPACE" "$pod" -- \
|
|
sh -c 'read -r BAO_TOKEN; export BAO_TOKEN; bao policy write "$1" -' sh "$POLICY_NAME"
|
|
}
|
|
|
|
token="$(read_token)"
|
|
if [ "$DRY_RUN" -eq 0 ] && [ "$USE_TOKEN_HELPER" -eq 0 ] && [ -z "$token" ]; then
|
|
echo "ERROR: empty OpenBao token" >&2
|
|
exit 1
|
|
fi
|
|
|
|
remote_bao "$token" status
|
|
write_policy "$token"
|
|
remote_bao "$token" policy read "$POLICY_NAME"
|
|
|
|
cat <<'NEXT'
|
|
|
|
Workload KV read-lane policy apply path completed.
|
|
|
|
Remaining live steps:
|
|
1. Confirm the whynot-design KeyCape/NetKingdom bound claim or service account.
|
|
2. Create auth/netkingdom/role/whynot-design-workload-kv-read with only the
|
|
workload-kv-read-whynot-design-npm-publish policy.
|
|
3. Provision platform/workloads/whynot-design/whynot-design/npm-publish with
|
|
field NPM_AUTH_TOKEN through approved OpenBao/operator custody.
|
|
4. Run positive and negative fetch verification without printing the token.
|
|
NEXT
|