github-ops
87 lines
2.5 KiB
Bash
Executable File
87 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
: "${BAO_ADDR:?BAO_ADDR is required}"
|
|
: "${BAO_ROLE_ID:?BAO_ROLE_ID is required}"
|
|
: "${BAO_SECRET_ID:?BAO_SECRET_ID is required}"
|
|
: "${OPENBAO_APP:?OPENBAO_APP is required}"
|
|
|
|
output="${OPENBAO_ENV_FILE:-.openbao-env}"
|
|
payload="$(mktemp)"
|
|
merged="$(mktemp)"
|
|
trap 'rm -f "$payload" "$merged"' EXIT
|
|
|
|
export BAO_ADDR
|
|
BAO_TOKEN="$(bao write -field=token auth/approle/login role_id="$BAO_ROLE_ID" secret_id="$BAO_SECRET_ID")"
|
|
export BAO_TOKEN
|
|
|
|
printf '{}\n' > "$merged"
|
|
|
|
merge_secret() {
|
|
local path="$1"
|
|
|
|
bao kv get -mount=ci -format=json "$path" > "$payload"
|
|
|
|
python3 - "$payload" "$merged" <<'PY'
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
|
|
merged_path = Path(sys.argv[2])
|
|
merged = json.loads(merged_path.read_text(encoding="utf-8"))
|
|
|
|
data = payload.get("data", {})
|
|
if isinstance(data, dict) and isinstance(data.get("data"), dict):
|
|
data = data["data"]
|
|
|
|
if not isinstance(data, dict):
|
|
raise SystemExit("OpenBao response does not contain an object secret payload")
|
|
|
|
merged.update({key: value for key, value in data.items() if value is not None})
|
|
merged_path.write_text(json.dumps(merged), encoding="utf-8")
|
|
PY
|
|
}
|
|
|
|
merge_secret "shared/registry"
|
|
merge_secret "shared/deploy-ssh"
|
|
merge_secret "projects/${OPENBAO_APP}/deploy"
|
|
merge_secret "projects/${OPENBAO_APP}/runtime"
|
|
|
|
python3 - "$merged" "$output" <<'PY'
|
|
import json
|
|
import re
|
|
import shlex
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
|
|
output_path = Path(sys.argv[2])
|
|
|
|
if "REGISTRY_USERNAME" in data and "DEPLOY_REGISTRY_USER" not in data:
|
|
data["DEPLOY_REGISTRY_USER"] = data["REGISTRY_USERNAME"]
|
|
|
|
if "REGISTRY_PASSWORD" in data and "DEPLOY_REGISTRY_TOKEN" not in data:
|
|
data["DEPLOY_REGISTRY_TOKEN"] = data["REGISTRY_PASSWORD"]
|
|
|
|
name_re = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
|
|
lines = [
|
|
"# Generated by scripts/load-openbao-env.sh",
|
|
"# Do not commit this file.",
|
|
]
|
|
|
|
for key in sorted(data):
|
|
if not name_re.match(key):
|
|
raise SystemExit(f"Unsupported environment variable name from OpenBao: {key}")
|
|
value = data[key]
|
|
if isinstance(value, bool):
|
|
value = "true" if value else "false"
|
|
elif not isinstance(value, str):
|
|
value = str(value)
|
|
lines.append(f"export {key}={shlex.quote(value)}")
|
|
|
|
output_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
|
|
output_path.chmod(0o600)
|
|
print(f"Loaded {len(lines) - 2} OpenBao values into {output_path}", file=sys.stderr)
|
|
PY
|