42 lines
960 B
Bash
Executable File
42 lines
960 B
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:18200}"
|
|
|
|
export VAULT_ADDR
|
|
|
|
if ! command -v vault >/dev/null 2>&1; then
|
|
echo "vault CLI is required" >&2
|
|
exit 1
|
|
fi
|
|
|
|
status_json="$(mktemp)"
|
|
trap 'rm -f "$status_json"' EXIT
|
|
|
|
if vault status -format=json >"$status_json" 2>/dev/null; then
|
|
:
|
|
else
|
|
if [[ ! -s "$status_json" ]]; then
|
|
echo "Vault transit provider is unreachable at ${VAULT_ADDR}" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
initialized="$(jq -r '.initialized' "$status_json")"
|
|
sealed="$(jq -r '.sealed' "$status_json")"
|
|
|
|
if [[ "$initialized" != "true" ]]; then
|
|
echo "Transit provider Vault is not initialized." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$sealed" == "true" ]]; then
|
|
cat >&2 <<'EOF'
|
|
Transit provider Vault is sealed.
|
|
Manual unseal is required before the CI reconcile workflow can continue.
|
|
Run the provider Vault runbook from runbooks/vault-transit/dev/README.md and unseal the vault-transit instance first.
|
|
EOF
|
|
exit 1
|
|
fi
|