mirror/ infrastructure
1
1
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/infrastructure.git synced 2024-06-09 13:06:04 +02:00
Code Issues
infrastructure/misc/vault-keyring-client.sh

9 lines
357 B
Bash
Raw Normal View History

Move highly sensitive secrets to new "super" vault The idea bebind this is to be able to give vault access to new DevOps members without giving away more important credentials like Hetzner's.
2022-05-01 14:26:32 +02:00
#!/bin/sh
misc/vault-keyring-client.sh: add flock workaround Otherwise running terraform under tf-stage2 will often fail with: > ansible.errors.AnsibleError: Vault password client script > ../misc/vault-keyring-client.sh did not find a secret for > vault-id=default: b'gpg: decryption failed: No secret key\n'
2022-05-09 22:07:17 +02:00
readonly vault_password_file_encrypted="$(dirname $0)/vault-$2-password.gpg"
misc/vault-keyring-client.sh: explain flock usage Fixes: 511b6ca4e127 ("misc/vault-keyring-client.sh: add flock workaround")
2022-08-25 04:50:30 +02:00
# flock used to work around "gpg: decryption failed: No secret key" in tf-stage2
# would otherwise need 'auto-expand-secmem' (https://dev.gnupg.org/T3530#106174)
misc/vault-keyring-client.sh: add flock workaround Otherwise running terraform under tf-stage2 will often fail with: > ansible.errors.AnsibleError: Vault password client script > ../misc/vault-keyring-client.sh did not find a secret for > vault-id=default: b'gpg: decryption failed: No secret key\n'
2022-05-09 22:07:17 +02:00
flock "$vault_password_file_encrypted" \
gpg --batch --decrypt --quiet "$vault_password_file_encrypted"