37 lines
780 B
Bash
37 lines
780 B
Bash
|
#!/bin/bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
: '
|
||
|
|
vault write auth/approle/role/triage_agent \
|
||
|
|
token_policies="agent_policy" \
|
||
|
|
token_ttl=1h \
|
||
|
|
token_max_ttl=4h \
|
||
|
|
secret_id_ttl=24h \
|
||
|
|
token_bound_cidrs="10.6.0.0/16"
|
||
|
|
'
|
||
|
|
|
||
|
|
VAULT_ADDR="https://10.6.2.1:8200"
|
||
|
|
if [ -z "${VAULT_TOKEN:-}" ]; then
|
||
|
|
read -r -s -p "VAULT_TOKEN: " VAULT_TOKEN
|
||
|
|
echo
|
||
|
|
fi
|
||
|
|
|
||
|
|
TARGET_DIR=${1:-'.'}
|
||
|
|
|
||
|
|
ROLE_NAME="triage_agent"
|
||
|
|
WRAP_TTL="600s"
|
||
|
|
CONFIG=$(mktemp)
|
||
|
|
chmod 600 "$CONFIG"
|
||
|
|
trap 'rm -f "$CONFIG"' EXIT
|
||
|
|
|
||
|
|
{
|
||
|
|
printf 'header = "X-Vault-Token: %s"\n' "$VAULT_TOKEN"
|
||
|
|
printf 'header = "X-Vault-Wrap-TTL: %s"\n' "$WRAP_TTL"
|
||
|
|
} > "$CONFIG"
|
||
|
|
|
||
|
|
curl -s -X POST -k -K "$CONFIG" \
|
||
|
|
"$VAULT_ADDR/v1/auth/approle/role/${ROLE_NAME}/secret-id" \
|
||
|
|
| jq -r '.wrap_info.token // .errors[0]' | tr -d '\n' > wrapped_secret_id
|
||
|
|
|
||
|
|
|