Fernando K pushed to branch main at Root / Serviços / DHCP Commits: 665ef955 by Fernando Monteiro Kiotheka at 2025-08-06T15:37:32-03:00 feat: use get-key-from-bao.sh - - - - - 2 changed files: - .gitlab-ci.yml - + get-key-from-bao.sh Changes: ===================================== .gitlab-ci.yml ===================================== @@ -3,15 +3,7 @@ stages: sync-dhcp: stage: deploy script: - - | - ssh-keygen -t ed25519 -f key -N '' -q >/dev/null 2>&1 - response=$(curl -X POST -H "X-Vault-Token: $CI_VAULT_TOKEN" \ - -d "{\"public_key\": \"$(cat key.pub)\"}" $CI_VAULT_ADDR/v1/$CI_VAULT_SIGNER_AUTHORITY_PATH \ - ) || { echo "Failed to retrieve SSH key: Request to Vault failed"; exit 1; } - signed_key=$(jq -r .data.signed_key <<<"$response") - [ "$signed_key" != "null" ] || { echo "Failed to retrieve SSH key: SSH key is empty"; exit 1; } - echo "$signed_key" > key-cert.pub - chmod 644 key-cert.pub + - bash get-key-from-bao.sh - chmod 755 ansible && cd ansible && ansible-playbook --private-key ../key sync_kea_dhcp.yml only: refs: ===================================== get-key-from-bao.sh ===================================== @@ -0,0 +1,11 @@ +#!/bin/sh +response=$(curl --no-progress-meter --request POST \ + --header "X-Vault-Token: $VAULT_TOKEN" --data '{"key_type": "ed25519"}' \ + "$VAULT_ADDR/v1/ssh-client-signer/issue/ansible") \ + || { echo "Failed to retrieve SSH key: Request to Vault failed"; exit 1; } +private_key=$(printf "%s" "$response" | jq --raw-output .data.private_key) +signed_key=$(printf "%s" "$response" | jq --raw-output .data.signed_key) +[ "$signed_key" != "null" ] && [ "$private_key" != "null" ] \ + || { echo "Failed to retrieve SSH key: SSH key is empty"; exit 1; } +printf "%s\n" "$private_key" >key && chmod 600 key +printf "%s\n" "$signed_key" >key-cert.pub && chmod 644 key-cert.pub View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dhcp/-/commit/665ef95502405e6ca56f... -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dhcp/-/commit/665ef95502405e6ca56f... You're receiving this email because of your account on gitlab.c3sl.ufpr.br.