infrastructure/misc/vault-keyring-client.sh

#!/bin/sh

readonly vault_password_file_encrypted="$(dirname $0)/vault-$2-password.gpg"

# often getting "gpg: decryption failed: No secret key" in tf-stage2
# seems to work with flock (issue last reproduced with gnupg 2.2.35)
flock "$vault_password_file_encrypted" \
  gpg --batch --decrypt --quiet "$vault_password_file_encrypted"
Move highly sensitive secrets to new "super" vault The idea bebind this is to be able to give vault access to new DevOps members without giving away more important credentials like Hetzner's. 2022-05-01 14:26:32 +02:00			`#!/bin/sh`
misc/vault-keyring-client.sh: add flock workaround Otherwise running terraform under tf-stage2 will often fail with: > ansible.errors.AnsibleError: Vault password client script > ../misc/vault-keyring-client.sh did not find a secret for > vault-id=default: b'gpg: decryption failed: No secret key\n' 2022-05-09 22:07:17 +02:00
			`readonly vault_password_file_encrypted="$(dirname $0)/vault-$2-password.gpg"`

			`# often getting "gpg: decryption failed: No secret key" in tf-stage2`
			`# seems to work with flock (issue last reproduced with gnupg 2.2.35)`
			`flock "$vault_password_file_encrypted" \`
			`gpg --batch --decrypt --quiet "$vault_password_file_encrypted"`