45 lines
1.4 KiB
Python
Executable File
45 lines
1.4 KiB
Python
Executable File
#!/usr/bin/python3
|
|
import argparse
|
|
import getpass
|
|
import json
|
|
import os
|
|
import ssl
|
|
import sys
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
parser = argparse.ArgumentParser(
|
|
description="Unwrap a response wrapping token and store the AppRole secret ID in the JSON configuration file.",
|
|
)
|
|
parser.add_argument("config", help="path to the JSON configuration file of the instance")
|
|
args = parser.parse_args()
|
|
|
|
with open(args.config) as file:
|
|
config = json.load(file)
|
|
|
|
if "vault_addr" not in config:
|
|
sys.exit(f"vault_addr is not set in {args.config}")
|
|
|
|
context = ssl.create_default_context(cafile=config.get("vault_cacert") or None)
|
|
request = urllib.request.Request(
|
|
f"{config['vault_addr'].rstrip('/')}/v1/sys/wrapping/unwrap",
|
|
data=b"{}",
|
|
headers={
|
|
"Content-Type": "application/json",
|
|
"X-Vault-Token": getpass.getpass("Wrapping token: "),
|
|
},
|
|
method="POST",
|
|
)
|
|
try:
|
|
with urllib.request.urlopen(request, context=context) as response:
|
|
config["secret_id"] = json.load(response)["data"]["secret_id"]
|
|
except urllib.error.HTTPError as error:
|
|
sys.exit(f"Vault returned {error.code} for sys/wrapping/unwrap: {error.read().decode()}")
|
|
|
|
descriptor = os.open(args.config, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
|
|
os.fchmod(descriptor, 0o600)
|
|
with os.fdopen(descriptor, "w") as file:
|
|
json.dump(config, file, indent=2)
|
|
file.write("\n")
|
|
print(f"The secret ID was written to {args.config}")
|