mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 10:13:58 +00:00
72 lines
2.0 KiB
Bash
Executable File
72 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck disable=SC1090
|
|
source "$SCRIPT_DIR/knoe_cfg.sh"
|
|
|
|
# Where k3s keeps the server join token on the first/control-plane server
|
|
TOKEN_FILE="${TOKEN_FILE:-/var/lib/rancher/k3s/server/node-token}"
|
|
|
|
# Pick a dedicated vault file so we don't stomp your existing vault.yml.
|
|
# Change this if you want it somewhere else.
|
|
VAULT_FILE="${VAULT_FILE:-infrastructure/inventory/group_vars/all/vault_k3s.yml}"
|
|
|
|
# Variable name to store in the vault
|
|
VAR_NAME="${VAR_NAME:-vault_k3s_token}"
|
|
|
|
if [[ ! -r "$TOKEN_FILE" ]]; then
|
|
echo "ERROR: Cannot read token file: $TOKEN_FILE"
|
|
echo "Are you running this on a k3s server (pi.knoe.org)?"
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v ansible-vault >/dev/null 2>&1; then
|
|
echo "ERROR: ansible-vault not found in PATH"
|
|
exit 1
|
|
fi
|
|
|
|
TOKEN="$(sudo cat "$TOKEN_FILE" | tr -d '\r\n')"
|
|
|
|
if [[ -z "$TOKEN" ]]; then
|
|
echo "ERROR: Token read from $TOKEN_FILE is empty"
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$(dirname "$VAULT_FILE")"
|
|
|
|
TMP="$(mktemp)"
|
|
trap 'rm -f "$TMP"' EXIT
|
|
|
|
# Build a vault yaml with exactly one variable
|
|
# (ansible-vault encrypt_string outputs a full YAML block)
|
|
ansible-vault encrypt_string \
|
|
--name "$VAR_NAME" \
|
|
"$TOKEN" > "$TMP"
|
|
|
|
# If the vault file already exists, avoid duplicate var definitions:
|
|
# - if VAR_NAME already present, we replace the whole file (simple + safe)
|
|
# - otherwise, append
|
|
if [[ -f "$VAULT_FILE" ]]; then
|
|
if grep -qE "^\s*${VAR_NAME}:" "$VAULT_FILE"; then
|
|
echo "Updating existing $VAR_NAME in $VAULT_FILE (replacing file contents)."
|
|
mv "$TMP" "$VAULT_FILE"
|
|
else
|
|
echo "Appending $VAR_NAME to $VAULT_FILE"
|
|
printf "\n" >> "$VAULT_FILE"
|
|
cat "$TMP" >> "$VAULT_FILE"
|
|
fi
|
|
else
|
|
echo "Creating vault file: $VAULT_FILE"
|
|
mv "$TMP" "$VAULT_FILE"
|
|
fi
|
|
|
|
chmod 0600 "$VAULT_FILE"
|
|
|
|
echo "Done."
|
|
echo "Wrote: $VAULT_FILE"
|
|
echo "Var: $VAR_NAME"
|
|
echo
|
|
echo "Verify with:"
|
|
echo " ansible -i infrastructure/inventory/hosts.ini pi.knoe.org -m assert -a 'that=${VAR_NAME} is defined' --ask-vault-pass"
|