refactor: reorganize GitOps control plane

2026-07-25 23:55:31 +09:00
parent d507ac6ee9
commit 293ee6fc97
191 changed files with 7046 additions and 9034 deletions
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:8200}"
+VAULT_INIT_OUTPUT="${VAULT_INIT_OUTPUT:-${REPO_ROOT}/.local/vault/dev-k3s-init.json}"
+
+for cmd in jq vault; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "$cmd is required" >&2
+    exit 1
+  fi
+done
+
+export VAULT_ADDR
+
+status_json() {
+  local output=""
+  local status_code=0
+
+  set +e
+  output="$(vault status -format=json 2>/dev/null)"
+  status_code=$?
+  set -e
+
+  if [[ "$status_code" -ne 0 && "$status_code" -ne 2 ]]; then
+    echo "Vault is not reachable at ${VAULT_ADDR}." >&2
+    return "$status_code"
+  fi
+  printf '%s\n' "$output"
+}
+
+unseal() {
+  local status=""
+  local unseal_key=""
+
+  status="$(status_json)"
+  if [[ "$(jq -r '.sealed' <<<"$status")" == "false" ]]; then
+    echo "Vault is already unsealed."
+    return
+  fi
+  if [[ ! -f "$VAULT_INIT_OUTPUT" ]]; then
+    echo "Init material is unavailable: ${VAULT_INIT_OUTPUT}" >&2
+    exit 1
+  fi
+
+  unseal_key="$(jq -er '.unseal_keys_b64[0]' "$VAULT_INIT_OUTPUT")"
+  vault operator unseal "$unseal_key" >/dev/null
+  echo "Vault is unsealed."
+}
+
+init() {
+  local status=""
+
+  status="$(status_json)"
+  if [[ "$(jq -r '.initialized' <<<"$status")" == "true" ]]; then
+    echo "Refusing initialization: Vault is already initialized." >&2
+    exit 1
+  fi
+  if [[ -e "$VAULT_INIT_OUTPUT" ]]; then
+    echo "Refusing to overwrite existing init material: ${VAULT_INIT_OUTPUT}" >&2
+    exit 1
+  fi
+
+  umask 077
+  mkdir -p "$(dirname "$VAULT_INIT_OUTPUT")"
+  vault operator init \
+    -key-shares=1 \
+    -key-threshold=1 \
+    -format=json >"$VAULT_INIT_OUTPUT"
+  chmod 0600 "$VAULT_INIT_OUTPUT"
+  unseal
+
+  echo "Dev Vault was initialized with a dev-only 1-of-1 Shamir key."
+  echo "Move ${VAULT_INIT_OUTPUT} to encrypted custody before continuing."
+}
+
+revoke_root() {
+  local root_token=""
+  local temporary=""
+
+  if [[ ! -f "$VAULT_INIT_OUTPUT" ]]; then
+    echo "Init material is unavailable: ${VAULT_INIT_OUTPUT}" >&2
+    exit 1
+  fi
+
+  root_token="$(jq -er '.root_token' "$VAULT_INIT_OUTPUT")"
+  VAULT_TOKEN="$root_token" vault token revoke -self
+
+  temporary="$(mktemp "${VAULT_INIT_OUTPUT}.XXXXXX")"
+  jq 'del(.root_token)' "$VAULT_INIT_OUTPUT" >"$temporary"
+  chmod 0600 "$temporary"
+  mv "$temporary" "$VAULT_INIT_OUTPUT"
+  echo "The initial root token was revoked and removed from the local init file."
+}
+
+case "${1:-}" in
+  init)
+    init
+    ;;
+  unseal)
+    unseal
+    ;;
+  revoke-root)
+    revoke_root
+    ;;
+  *)
+    echo "Usage: $0 <init|unseal|revoke-root>" >&2
+    exit 1
+    ;;
+esac