bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: switch openbao loading to approle
CI / Rust Checks (push) Has been cancelled
Details
CI / UI Checks (push) Has been cancelled
Details
CI / Frontend E2E (push) Has been cancelled
Details
CI / Deployment Manifests (push) Has been cancelled
Details
Deploy / build-images (apps/admin-api/Dockerfile, git.itexp.me/bsodfather/crank-community-admin-api, admin-api) (push) Has been cancelled
Details
Deploy / build-images (apps/mcp-server/Dockerfile, git.itexp.me/bsodfather/crank-community-mcp-server, mcp-server) (push) Has been cancelled
Details
Deploy / build-images (apps/ui/Dockerfile, git.itexp.me/bsodfather/crank-community-ui, ui) (push) Has been cancelled
Details
Deploy / deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
github-ops
2026-06-16 17:50:18 +00:00
parent 1b528106b7
commit 7ab04aab2d
7 changed files with 108 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/README.md
+13 -4
View File
@@ -40,16 +40,25 @@ Usage:
## load-openbao-env.sh
Loads one OpenBao KV secret into a local shell env file.
Logs in to OpenBao with AppRole and loads Community deploy/runtime secrets into a local shell env file.
Required environment variables:
- `BAO_ADDR`
- `BAO_TOKEN`
- `BAO_SECRET_PATH`
- `BAO_ROLE_ID`
- `BAO_SECRET_ID`
- `OPENBAO_APP`
Optional environment variables:
- `OPENBAO_ENV_FILE`, defaults to `.openbao-env`
The script supports both KV v1 and KV v2 response shapes.
The script reads KV v2 secrets from mount `ci`:
- `shared/registry`
- `shared/deploy-ssh`
- `projects/${OPENBAO_APP}/deploy`
- `projects/${OPENBAO_APP}/runtime`
It also exposes `REGISTRY_USERNAME` and `REGISTRY_PASSWORD` as the workflow-compatible
aliases `DEPLOY_REGISTRY_USER` and `DEPLOY_REGISTRY_TOKEN`.