synchronize kubernetes auth method in recoincile script
This commit is contained in:
@@ -1,5 +1,8 @@
|
|||||||
#!/usr/bin/env python
|
#!/usr/bin/env python
|
||||||
|
|
||||||
|
from hvac.api.auth_methods.kubernetes import Kubernetes
|
||||||
|
|
||||||
|
|
||||||
import argparse
|
import argparse
|
||||||
import os
|
import os
|
||||||
from hvac.api.system_backend import mount
|
from hvac.api.system_backend import mount
|
||||||
@@ -30,6 +33,13 @@ def synchronize_policies(client: hvac.Client):
|
|||||||
print(f'Updating policy: {policy_name}')
|
print(f'Updating policy: {policy_name}')
|
||||||
client.sys.create_or_update_acl_policy(policy_name, policy_content)
|
client.sys.create_or_update_acl_policy(policy_name, policy_content)
|
||||||
|
|
||||||
|
# Read vault/kubernetes-config.yaml and write it to kubernetes auth method config
|
||||||
|
def synchronize_auth_kubernetes_config(client: hvac.Client):
|
||||||
|
config_file = os.path.join(os.path.dirname(__file__), '../vault/kubernetes-config.yaml')
|
||||||
|
with open(config_file, 'r') as f:
|
||||||
|
config = yaml.safe_load(f.read())
|
||||||
|
client.write_data('/auth/kubernetes/config', data=config)
|
||||||
|
|
||||||
# Read vault/kubernetes-roles dir then write what is there and delete missing
|
# Read vault/kubernetes-roles dir then write what is there and delete missing
|
||||||
def synchronize_kubernetes_roles(client: hvac.Client):
|
def synchronize_kubernetes_roles(client: hvac.Client):
|
||||||
kubernetes = Kubernetes(client.adapter)
|
kubernetes = Kubernetes(client.adapter)
|
||||||
@@ -71,5 +81,8 @@ if __name__ == '__main__':
|
|||||||
print('Synchronizing policies')
|
print('Synchronizing policies')
|
||||||
synchronize_policies(client)
|
synchronize_policies(client)
|
||||||
|
|
||||||
|
print('Synchronizing kubernetes config')
|
||||||
|
synchronize_auth_kubernetes_config(client)
|
||||||
|
|
||||||
print('Synchronizing kubernetes roles')
|
print('Synchronizing kubernetes roles')
|
||||||
synchronize_kubernetes_roles(client)
|
synchronize_kubernetes_roles(client)
|
||||||
|
|||||||
1
vault/kubernetes-config.yaml
Normal file
1
vault/kubernetes-config.yaml
Normal file
@@ -0,0 +1 @@
|
|||||||
|
kubernetes_host: https://10.43.0.1:443
|
||||||
Reference in New Issue
Block a user