Настройка интеграции с HashiCorp Vault в профиле кластера

bash /dev/stdin <<'EOF'
set -euo pipefail

: "${VAULT_ADDRESS:?Задайте VAULT_ADDRESS, например https://vault.example.shturval.link}"

VSO_NAMESPACE="${VSO_NAMESPACE:-vault-operator}"
VSO_SSC_NAME="${VSO_SSC_NAME:-vault-secrets-operator}"
VSO_SSC_CRD_NAME="${VSO_SSC_CRD_NAME:-vault-secrets-operator-crds}"
VSO_CHART_NAME="${VSO_CHART_NAME:-vault-secrets-operator}"
VSO_CRD_CHART_NAME="${VSO_CRD_CHART_NAME:-vault-secrets-operator-crds}"
VSO_REPONAME="${VSO_REPONAME:-shturval}"
VSO_VERSION="${VSO_VERSION:-2.14.0}"

VAULTCONNECTION_NAME="${VAULTCONNECTION_NAME:-vault-connection-name}"
VAULT_CACERT_SECRET_REF="${VAULT_CACERT_SECRET_REF:-vault-ca}"
VAULT_CA_CERT_PATH="${VAULT_CA_CERT_PATH:-}"
VAULT_SKIP_TLS_VERIFY="${VAULT_SKIP_TLS_VERIFY:-false}"

MGMT_NAMESPACE="${MGMT_NAMESPACE:-kube-system}"
PROFILE_LABEL_VALUE="${PROFILE_LABEL_VALUE:-vault}"
MANIFESTS_SECRET_NAME="${MANIFESTS_SECRET_NAME:-vault-profile-manifests}"
CLUSTERPROFILE_NAME="${CLUSTERPROFILE_NAME:-vault-client-cluster-profile}"

b64_oneline() {
  # Для GNU coreutils используется base64 -w0, в остальных случаях переводы строк удаляются отдельно.
  if base64 --help 2>/dev/null | grep -q -- ' -w'; then
    base64 -w0
  else
    base64 | tr -d '\n'
  fi
}

SSC_YAML=$(cat <<EOF2
apiVersion: ops.shturval.tech/v1beta1
kind: ShturvalServiceConfig
metadata:
  name: ${VSO_SSC_NAME}
spec:
  dependency:
  - ${VSO_SSC_CRD_NAME}
  mode: auto
  namespace: ${VSO_NAMESPACE}
  chart: ${VSO_CHART_NAME}
  reponame: ${VSO_REPONAME}
  version: ${VSO_VERSION}
EOF2
)

SSC_CRD_YAML=$(cat <<EOF2
apiVersion: ops.shturval.tech/v1beta1
kind: ShturvalServiceConfig
metadata:
  name: ${VSO_SSC_CRD_NAME}
spec:
  mode: auto
  namespace: ${VSO_NAMESPACE}
  chart: ${VSO_CRD_CHART_NAME}
  reponame: ${VSO_REPONAME}
  version: ${VSO_VERSION}
EOF2
)

VAULT_CACERT_LINE=""
VAULT_CA_SECRET_ENTRY=""

if [ "${VAULT_SKIP_TLS_VERIFY}" != "true" ]; then
  : "${VAULT_CA_CERT_PATH:?Задайте VAULT_CA_CERT_PATH, если VAULT_SKIP_TLS_VERIFY=false}"

  VAULT_CACERT_LINE="  caCertSecretRef: ${VAULT_CACERT_SECRET_REF}"
  VAULT_CA_CERT_B64=$(b64_oneline < "${VAULT_CA_CERT_PATH}")
  VAULT_CA_SECRET_YAML=$(cat <<EOF2
apiVersion: v1
kind: Secret
metadata:
  name: ${VAULT_CACERT_SECRET_REF}
  namespace: ${VSO_NAMESPACE}
type: Opaque
data:
  ca.crt: ${VAULT_CA_CERT_B64}
EOF2
)
  VAULT_CA_SECRET_B64=$(printf '%s' "$VAULT_CA_SECRET_YAML" | b64_oneline)
  VAULT_CA_SECRET_ENTRY="  vaultcasecret: ${VAULT_CA_SECRET_B64}"
fi

VAULTCONNECTION_YAML=$(cat <<EOF2
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultConnection
metadata:
  name: ${VAULTCONNECTION_NAME}
  namespace: ${VSO_NAMESPACE}
spec:
  address: ${VAULT_ADDRESS}
${VAULT_CACERT_LINE}
  skipTLSVerify: ${VAULT_SKIP_TLS_VERIFY}
EOF2
)

SSC_B64=$(printf '%s' "$SSC_YAML" | b64_oneline)
SSC_CRD_B64=$(printf '%s' "$SSC_CRD_YAML" | b64_oneline)
VAULTCONNECTION_B64=$(printf '%s' "$VAULTCONNECTION_YAML" | b64_oneline)

kubectl apply -f - <<EOF2
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: ${MANIFESTS_SECRET_NAME}
  namespace: ${MGMT_NAMESPACE}
  labels:
    cluster.shturval.tech/manifest: ""
    profile: ${PROFILE_LABEL_VALUE}
data:
  ssc: ${SSC_B64}
  crd: ${SSC_CRD_B64}
${VAULT_CA_SECRET_ENTRY}
  vaultconnection: ${VAULTCONNECTION_B64}
EOF2

kubectl apply -f - <<EOF2
apiVersion: cluster.shturval.tech/v1beta1
kind: ClusterProfile
metadata:
  name: ${CLUSTERPROFILE_NAME}
  namespace: ${MGMT_NAMESPACE}
spec:
  customManifests:
    - clientManifestsSelector:
        matchLabels:
          profile: ${PROFILE_LABEL_VALUE}
EOF2
EOF