dsrptlab/clientsflow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(vault): read unseal key from init.json fallback

Browse Source
This commit is contained in:
Ruslan Bakiev
2026-03-10 20:41:51 +07:00
parent 08a31383f0
commit 8eec280b9d
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
vault/entrypoint.sh
View File

@@ -17,10 +17,16 @@ INITIALIZED=$(vault status -format=json 2>/dev/null | grep '"initialized"' | gre
if [ "$INITIALIZED" != "1" ]; then if [ "$INITIALIZED" != "1" ]; then
echo "Vault not initialized, running operator init..." echo "Vault not initialized, running operator init..."
vault operator init -key-shares=1 -key-threshold=1 -format=json > /vault/data/init.json vault operator init -key-shares=1 -key-threshold=1 -format=json > /vault/data/init.json
VAULT_UNSEAL_KEY=$(cat /vault/data/init.json | grep -o '"unseal_keys_b64":\["[^"]*"' | grep -o '\["[^"]*"' | tr -d '["') VAULT_UNSEAL_KEY=$(cat /vault/data/init.json | sed -n 's/.*"unseal_keys_b64":\["\([^"]*\)".*/\1/p')
export VAULT_UNSEAL_KEY
echo "Vault initialized. Unseal key saved to /vault/data/init.json" echo "Vault initialized. Unseal key saved to /vault/data/init.json"
fi fi
# If no env key, try to read from saved init.json
if [ -z "$VAULT_UNSEAL_KEY" ] && [ -f /vault/data/init.json ]; then
VAULT_UNSEAL_KEY=$(cat /vault/data/init.json | sed -n 's/.*"unseal_keys_b64":\["\([^"]*\)".*/\1/p')
fi
# Auto-unseal # Auto-unseal
if [ -n "$VAULT_UNSEAL_KEY" ]; then if [ -n "$VAULT_UNSEAL_KEY" ]; then
SEALED=$(vault status -format=json 2>/dev/null | grep '"sealed"' | grep -c 'true' || true) SEALED=$(vault status -format=json 2>/dev/null | grep '"sealed"' | grep -c 'true' || true)
@@ -32,7 +38,7 @@ if [ -n "$VAULT_UNSEAL_KEY" ]; then
echo "Vault is already unsealed." echo "Vault is already unsealed."
fi fi
else else
echo "VAULT_UNSEAL_KEY not set, skipping auto-unseal." echo "VAULT_UNSEAL_KEY not set and no init.json found, skipping auto-unseal."
fi fi
# Wait for Vault process # Wait for Vault process