Ben Vincent
ca87702466
- ensure the vault service resource subscribes to the ssl crt/key - update unseal script to retry unseal process until it completes
29 lines
703 B
Plaintext
29 lines
703 B
Plaintext
#!/bin/bash
|
|
|
|
# Script to unseal Vault
|
|
|
|
VAULT_ADDR='<%= @vault_address %>'
|
|
UNSEAL_KEYS_FILE='/etc/vault/unseal_keys'
|
|
|
|
while true; do
|
|
# Check if Vault is sealed
|
|
is_sealed=$(curl -s ${VAULT_ADDR}/v1/sys/seal-status | jq -r '.sealed')
|
|
if [ "$is_sealed" == "false" ]; then
|
|
echo "Vault is already unsealed."
|
|
break
|
|
fi
|
|
|
|
# Retrieve unseal keys from plaintext file
|
|
unseal_keys=$(cat "$UNSEAL_KEYS_FILE")
|
|
|
|
# Loop through the unseal keys and use them to unseal Vault
|
|
for key in $unseal_keys; do
|
|
curl --request PUT --data '{"key": "'$key'"}' $VAULT_ADDR/v1/sys/unseal
|
|
done
|
|
|
|
echo "Attempted to unseal Vault. Checking if still sealed..."
|
|
sleep 1
|
|
done
|
|
|
|
echo "Vault has been unsealed."
|