Separated functions of the Python script.

vault_unwrap_secret_id.py

@@ -0,0 +1,44 @@
+#!/usr/bin/python3
+import argparse
+import getpass
+import json
+import os
+import ssl
+import sys
+import urllib.error
+import urllib.request
+
+parser = argparse.ArgumentParser(
+    description="Unwrap a response wrapping token and store the AppRole secret ID in the JSON configuration file.",
+)
+parser.add_argument("config", help="path to the JSON configuration file of the instance")
+args = parser.parse_args()
+
+with open(args.config) as file:
+    config = json.load(file)
+
+if "vault_addr" not in config:
+    sys.exit(f"vault_addr is not set in {args.config}")
+
+context = ssl.create_default_context(cafile=config.get("vault_cacert") or None)
+request = urllib.request.Request(
+    f"{config['vault_addr'].rstrip('/')}/v1/sys/wrapping/unwrap",
+    data=b"{}",
+    headers={
+        "Content-Type": "application/json",
+        "X-Vault-Token": getpass.getpass("Wrapping token: "),
+    },
+    method="POST",
+)
+try:
+    with urllib.request.urlopen(request, context=context) as response:
+        config["secret_id"] = json.load(response)["data"]["secret_id"]
+except urllib.error.HTTPError as error:
+    sys.exit(f"Vault returned {error.code} for sys/wrapping/unwrap: {error.read().decode()}")
+
+descriptor = os.open(args.config, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+os.fchmod(descriptor, 0o600)
+with os.fdopen(descriptor, "w") as file:
+    json.dump(config, file, indent=2)
+    file.write("\n")
+print(f"The secret ID was written to {args.config}")