init: 폴더구조 설계 및 인프라 설계

2026-07-24 14:31:53 +09:00
parent 34ad612281
commit f9c463f87a
1839 changed files with 323096 additions and 1 deletions
@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# Vault helper functions. Depends on lib/common.sh being sourced first.
+#
+# Environment contract:
+#   VAULT_NAMESPACE     — k8s namespace where vault-0 runs (default: mnt)
+#   VAULT_POD           — Vault pod name                  (default: vault-0)
+#   VAULT_KEYS_FILE     — path to JSON file produced by vault operator init
+#                          (default: $REPO_ROOT/vault-init-keys.json)
+
+# shellcheck shell=bash
+# shellcheck source=./common.sh
+# (common.sh must be sourced by the caller.)
+
+: "${VAULT_NAMESPACE:=mnt}"
+: "${VAULT_POD:=vault-0}"
+
+# vault_exec <args...> — exec vault CLI inside the Vault pod.
+# -i 를 붙여서 호출자의 stdin 을 컨테이너로 파이프 (vault login -no-print - 등).
+vault_exec() {
+  kubectl exec -i -n "$VAULT_NAMESPACE" "$VAULT_POD" -- vault "$@"
+}
+
+# vault_exec_sh <script> — exec /bin/sh -c "$script" inside the Vault pod.
+# Use when the vault CLI call needs shell features (heredocs, redirects, stdin).
+vault_exec_sh() {
+  kubectl exec -i -n "$VAULT_NAMESPACE" "$VAULT_POD" -- sh -c "$1"
+}
+
+# vault_status_json — echoes the JSON output of `vault status`, or empty on error.
+vault_status_json() {
+  kubectl exec -n "$VAULT_NAMESPACE" "$VAULT_POD" -- \
+    vault status -format=json 2>/dev/null || true
+}
+
+vault_is_initialized() {
+  local json
+  json="$(vault_status_json)"
+  [[ -n "$json" ]] && echo "$json" | jq -e '.initialized == true' >/dev/null
+}
+
+vault_is_sealed() {
+  local json
+  json="$(vault_status_json)"
+  [[ -n "$json" ]] && echo "$json" | jq -e '.sealed == true' >/dev/null
+}
+
+# vault_unseal_from_keyfile <keys_file>
+#
+# 주의: `vault operator unseal <KEY>` 형태로 argv 에 키를 넘기면 `ps` 로
+# 노출된다 (container 내부 프로세스라도 보안 경계는 유지). vault CLI 는
+# argv 가 없으면 stdin 에서 읽으므로 stdin 으로만 전달한다.
+vault_unseal_from_keyfile() {
+  local keys_file="$1"
+  [[ -f "$keys_file" ]] || die "unseal 키 파일이 없습니다: $keys_file"
+
+  local threshold
+  threshold="$(jq -r '.unseal_threshold' "$keys_file")"
+
+  local i key
+  for ((i = 0; i < threshold; i++)); do
+    key="$(jq -r ".unseal_keys_b64[$i]" "$keys_file")"
+    vault_exec operator unseal "$key" >/dev/null
+  done
+  unset key
+  log "Vault unseal 완료 (threshold=${threshold})"
+}
+
+# vault_login_root_from_keyfile <keys_file>
+# Logs the vault CLI inside the pod using the root token. stdout is suppressed
+# so the token never reaches terminals or logs.
+vault_login_root_from_keyfile() {
+  local keys_file="$1"
+  local token
+  token="$(jq -r '.root_token' "$keys_file")"
+  printf '%s' "$token" | vault_exec_sh 'vault login -no-print -' >/dev/null
+}
+
+# vault_kv_exists <path>  — returns 0 if the KV v2 secret exists.
+vault_kv_exists() {
+  local path="$1"
+  [[ "$path" == secret/* ]] || path="secret/${path}"
+  vault_exec kv get -format=json "$path" >/dev/null 2>&1
+}
+
+# vault_auth_method_enabled <mount>  — returns 0 if the auth method is enabled.
+vault_auth_method_enabled() {
+  local mount="$1"
+  vault_exec auth list -format=json 2>/dev/null \
+    | jq -e --arg m "${mount}/" '.[$m] // empty' >/dev/null
+}
+
+# vault_secrets_engine_enabled <mount>  — returns 0 if the secrets engine is enabled.
+vault_secrets_engine_enabled() {
+  local mount="$1"
+  vault_exec secrets list -format=json 2>/dev/null \
+    | jq -e --arg m "${mount}/" '.[$m] // empty' >/dev/null
+}