114 lines
2.6 KiB
Bash
Executable File
114 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:8200}"
|
|
VAULT_INIT_OUTPUT="${VAULT_INIT_OUTPUT:-${REPO_ROOT}/.local/vault/dev-k3s-init.json}"
|
|
|
|
for cmd in jq vault; do
|
|
if ! command -v "$cmd" >/dev/null 2>&1; then
|
|
echo "$cmd is required" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
export VAULT_ADDR
|
|
|
|
status_json() {
|
|
local output=""
|
|
local status_code=0
|
|
|
|
set +e
|
|
output="$(vault status -format=json 2>/dev/null)"
|
|
status_code=$?
|
|
set -e
|
|
|
|
if [[ "$status_code" -ne 0 && "$status_code" -ne 2 ]]; then
|
|
echo "Vault is not reachable at ${VAULT_ADDR}." >&2
|
|
return "$status_code"
|
|
fi
|
|
printf '%s\n' "$output"
|
|
}
|
|
|
|
unseal() {
|
|
local status=""
|
|
local unseal_key=""
|
|
|
|
status="$(status_json)"
|
|
if [[ "$(jq -r '.sealed' <<<"$status")" == "false" ]]; then
|
|
echo "Vault is already unsealed."
|
|
return
|
|
fi
|
|
if [[ ! -f "$VAULT_INIT_OUTPUT" ]]; then
|
|
echo "Init material is unavailable: ${VAULT_INIT_OUTPUT}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
unseal_key="$(jq -er '.unseal_keys_b64[0]' "$VAULT_INIT_OUTPUT")"
|
|
vault operator unseal "$unseal_key" >/dev/null
|
|
echo "Vault is unsealed."
|
|
}
|
|
|
|
init() {
|
|
local status=""
|
|
|
|
status="$(status_json)"
|
|
if [[ "$(jq -r '.initialized' <<<"$status")" == "true" ]]; then
|
|
echo "Refusing initialization: Vault is already initialized." >&2
|
|
exit 1
|
|
fi
|
|
if [[ -e "$VAULT_INIT_OUTPUT" ]]; then
|
|
echo "Refusing to overwrite existing init material: ${VAULT_INIT_OUTPUT}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
umask 077
|
|
mkdir -p "$(dirname "$VAULT_INIT_OUTPUT")"
|
|
vault operator init \
|
|
-key-shares=1 \
|
|
-key-threshold=1 \
|
|
-format=json >"$VAULT_INIT_OUTPUT"
|
|
chmod 0600 "$VAULT_INIT_OUTPUT"
|
|
unseal
|
|
|
|
echo "Dev Vault was initialized with a dev-only 1-of-1 Shamir key."
|
|
echo "Move ${VAULT_INIT_OUTPUT} to encrypted custody before continuing."
|
|
}
|
|
|
|
revoke_root() {
|
|
local root_token=""
|
|
local temporary=""
|
|
|
|
if [[ ! -f "$VAULT_INIT_OUTPUT" ]]; then
|
|
echo "Init material is unavailable: ${VAULT_INIT_OUTPUT}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
root_token="$(jq -er '.root_token' "$VAULT_INIT_OUTPUT")"
|
|
VAULT_TOKEN="$root_token" vault token revoke -self
|
|
|
|
temporary="$(mktemp "${VAULT_INIT_OUTPUT}.XXXXXX")"
|
|
jq 'del(.root_token)' "$VAULT_INIT_OUTPUT" >"$temporary"
|
|
chmod 0600 "$temporary"
|
|
mv "$temporary" "$VAULT_INIT_OUTPUT"
|
|
echo "The initial root token was revoked and removed from the local init file."
|
|
}
|
|
|
|
case "${1:-}" in
|
|
init)
|
|
init
|
|
;;
|
|
unseal)
|
|
unseal
|
|
;;
|
|
revoke-root)
|
|
revoke_root
|
|
;;
|
|
*)
|
|
echo "Usage: $0 <init|unseal|revoke-root>" >&2
|
|
exit 1
|
|
;;
|
|
esac
|