Deployment

2026-09-25 19:44:48 +03:00
parent 596adfdc09
commit 066bfb3c0b
24 changed files with 472 additions and 151 deletions
@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+
+: '
+vault write auth/approle/role/triage_agent \
+    token_policies="agent_policy" \
+    token_ttl=1h \
+    token_max_ttl=4h \
+    secret_id_ttl=24h \
+    token_bound_cidrs="10.6.0.0/16"
+'
+
+VAULT_ADDR="https://10.6.2.1:8200"
+if [ -z "${VAULT_TOKEN:-}" ]; then
+  read -r -s -p "VAULT_TOKEN: " VAULT_TOKEN
+  echo
+fi
+
+TARGET_DIR=${1:-'.'}
+
+ROLE_NAME="triage_agent"
+WRAP_TTL="600s"
+CONFIG=$(mktemp)
+chmod 600 "$CONFIG"
+trap 'rm -f "$CONFIG"' EXIT
+
+{
+  printf 'header = "X-Vault-Token: %s"\n' "$VAULT_TOKEN"
+  printf 'header = "X-Vault-Wrap-TTL: %s"\n' "$WRAP_TTL"
+} > "$CONFIG"
+
+curl -s -X POST -k -K "$CONFIG" \
+  "$VAULT_ADDR/v1/auth/approle/role/${ROLE_NAME}/secret-id" \
+  | jq -r '.wrap_info.token // .errors[0]' | tr -d '\n' > wrapped_secret_id
+
+