debug-kubernetes-vault-integration.md

debug-kubernetes-vault-integration

cat > ~/vault_debug.sh <<'EOF'
#!/usr/bin/env bash
# Usage:
#bash -x ~/vault_debug.sh sumsub https://vault.qa.fasten.cloud kubernetes secret/api/auth/gazprom sumsub-vault

VAULT_ROLE=$1
VAULT_ADDR=$2
VAULT_KUBERNETES_PATH=$3
VAULT_SECRET_PATH=$4
KUBE_SA_NAME=$5

if [[ -z $KUBE_SA_NAME ]];
  then
    KUBE_SA_NAME=${VAULT_ROLE}
fi

KUBE_TOKEN_NAME=$(kubectl get serviceaccount ${KUBE_SA_NAME} -ojson | jq -r '.secrets[].name' 2>/dev/null ) && \
KUBE_TOKEN=$(kubectl get secret ${KUBE_TOKEN_NAME} -ojson | jq -r '.data.token') && \
KUBE_JWT=$(echo $KUBE_TOKEN | base64 --decode) \
|| KUBE_TOKEN=$(kubectl create token ${VAULT_ROLE}) && KUBE_JWT=${KUBE_TOKEN}

VAULT_TOKEN=$(curl -s -XPOST ${VAULT_ADDR}/v1/auth/$VAULT_KUBERNETES_PATH/login -d '{ "jwt": "'$KUBE_JWT'", "role": "'$VAULT_ROLE'"}'| jq -r .auth.client_token)
curl -s -H "X-Vault-Token: $VAULT_TOKEN" ${VAULT_ADDR}/v1/$VAULT_SECRET_PATH | jq -r 
EOF