99 lines
2.4 KiB
Go
99 lines
2.4 KiB
Go
package secrets_storage
|
|
|
|
import (
|
|
"fmt"
|
|
"kube-forge/pkg/config"
|
|
"kube-forge/pkg/kubernetes_client"
|
|
"kube-forge/pkg/templates"
|
|
"regexp"
|
|
"strings"
|
|
)
|
|
|
|
func InitVault() {
|
|
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
|
|
if err != nil {
|
|
fmt.Println(err.Error())
|
|
return
|
|
}
|
|
err = commandToInitVault()
|
|
if err != nil {
|
|
fmt.Println(err.Error())
|
|
return
|
|
}
|
|
fmt.Println("Vault initialized")
|
|
templates.ApplyVaultInitKeysTemplate()
|
|
}
|
|
|
|
func UnsealVault() {
|
|
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
|
|
if err != nil {
|
|
fmt.Println(err.Error())
|
|
return
|
|
}
|
|
commandToUnsealVault()
|
|
}
|
|
|
|
// func getRunningVault(ctx context.Context, podName string, podNamespace string, responseChan chan<- error) {
|
|
// time.Sleep(1 * time.Minute)
|
|
// _, err := kubernetes_client.GetPodByName(ctx, podName, podNamespace)
|
|
// if err != nil {
|
|
// responseChan <- err
|
|
// }
|
|
|
|
// commandToUnsealVault()
|
|
// responseChan <- nil
|
|
// close(responseChan)
|
|
// }
|
|
|
|
func commandToInitVault() error {
|
|
config := config.GetConfig()
|
|
|
|
command := fmt.Sprintf(
|
|
"vault operator init -key-shares=%d -key-threshold=%d",
|
|
config.Modules.SecretsStorage.KeyShares,
|
|
config.Modules.SecretsStorage.KeyThreshold,
|
|
)
|
|
output, err := kubernetes_client.ExecuteCommandInPodContainer(
|
|
command, "secrets-storage", "vault-0", "vault",
|
|
)
|
|
if err != nil && strings.Contains(output, "Vault is already initialized") {
|
|
return VaultAlreadyInitialised
|
|
}
|
|
|
|
unsealKeys, rootToken := parseVaultInitKeys(output)
|
|
config.Modules.SecretsStorage.UnsealKeys = unsealKeys
|
|
config.Modules.SecretsStorage.RootToken = rootToken
|
|
return nil
|
|
}
|
|
|
|
func parseVaultInitKeys(input string) ([]string, string) {
|
|
unsealKeyPattern := regexp.MustCompile(`Unseal Key \d+: (\S+)`)
|
|
rootTokenPattern := regexp.MustCompile(`Initial Root Token: (\S+)`)
|
|
|
|
unsealKeysMatches := unsealKeyPattern.FindAllStringSubmatch(input, -1)
|
|
var unsealKeys []string
|
|
for _, match := range unsealKeysMatches {
|
|
unsealKeys = append(unsealKeys, match[1])
|
|
}
|
|
|
|
rootTokenMatches := rootTokenPattern.FindStringSubmatch(input)
|
|
rootToken := rootTokenMatches[1]
|
|
|
|
return unsealKeys, rootToken
|
|
}
|
|
|
|
func commandToUnsealVault() {
|
|
config := config.GetConfig()
|
|
|
|
for _, unsealKey := range config.Modules.SecretsStorage.UnsealKeys {
|
|
command := fmt.Sprintf(
|
|
"vault operator unseal %s",
|
|
unsealKey,
|
|
)
|
|
kubernetes_client.ExecuteCommandInPodContainer(
|
|
command, "secrets-storage", "vault-0", "vault",
|
|
)
|
|
}
|
|
fmt.Println("Vault unsealed")
|
|
}
|