donghyeon.kang/project-gitops
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor(gitops): establish platform ownership boundaries

Browse Source
This commit is contained in:
donghyeon-ka
2026-07-26 01:34:29 +09:00
parent 293ee6fc97
commit a6f6c663e0
121 changed files with 2801 additions and 1204 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hack/vault-init.sh
+44 -1
View File
@@ -7,7 +7,7 @@ REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:8200}"
VAULT_INIT_OUTPUT="${VAULT_INIT_OUTPUT:-${REPO_ROOT}/.local/vault/dev-k3s-init.json}"
for cmd in jq vault; do
for cmd in jq rg vault; do
if ! command -v "$cmd" >/dev/null 2>&1; then
echo "$cmd is required" >&2
exit 1
@@ -78,13 +78,56 @@ init() {
}
revoke_root() {
local database_lookup=""
local database_token="${VAULT_DATABASE_TOKEN:-}"
local root_token=""
local temporary=""
local workloads_lookup=""
local workloads_token="${VAULT_WORKLOADS_TOKEN:-}"
if [[ ! -f "$VAULT_INIT_OUTPUT" ]]; then
echo "Init material is unavailable: ${VAULT_INIT_OUTPUT}" >&2
exit 1
fi
if [[ -z "$workloads_token" || -z "$database_token" ]]; then
echo "Refusing root revocation: VAULT_WORKLOADS_TOKEN and VAULT_DATABASE_TOKEN are required." >&2
exit 1
fi
if ! VAULT_TOKEN="$workloads_token" \
vault token capabilities sys/policies/acl/auth-server-dev |
rg -q '(^|,|[[:space:]])update($|,|[[:space:]])'; then
echo "Refusing root revocation: the workloads replacement token failed its capability check." >&2
exit 1
fi
if ! VAULT_TOKEN="$database_token" \
vault token capabilities database/config/auth-system-postgres-dev |
rg -q '(^|,|[[:space:]])update($|,|[[:space:]])'; then
echo "Refusing root revocation: the database replacement token failed its capability check." >&2
exit 1
fi
if ! workloads_lookup="$(
VAULT_TOKEN="$workloads_token" vault token lookup -format=json
)"; then
echo "Refusing root revocation: the workloads replacement token cannot look itself up." >&2
exit 1
fi
if ! database_lookup="$(
VAULT_TOKEN="$database_token" vault token lookup -format=json
)"; then
echo "Refusing root revocation: the database replacement token cannot look itself up." >&2
exit 1
fi
if ! jq -e '.data.policies | type == "array"' <<<"$workloads_lookup" >/dev/null ||
! jq -e '.data.policies | type == "array"' <<<"$database_lookup" >/dev/null; then
echo "Refusing root revocation: a replacement token returned an invalid lookup response." >&2
exit 1
fi
if jq -e '.data.policies | index("root") != null' <<<"$workloads_lookup" >/dev/null ||
jq -e '.data.policies | index("root") != null' <<<"$database_lookup" >/dev/null; then
echo "Refusing root revocation: a replacement token unexpectedly carries the root policy." >&2
exit 1
fi
root_token="$(jq -er '.root_token' "$VAULT_INIT_OUTPUT")"
VAULT_TOKEN="$root_token" vault token revoke -self