sh 开封保险柜

Posted 2021-05-06

#!/bin/bash

kubectl \
    --kubeconfig <PATH_TO_KUBECONFIG> \
    -n control get po -l app=vault --no-headers |\
    awk '{print $1}' |\
    xargs -I % kubectl \
    --kubeconfig <PATH_TO_KUBECONFIG> -n control exec -c vault\
    % -- sh -c "vault operator unseal -address=http://127.0.0.1:8200 $(kubectl --kubeconfig <PATH_TO_KUBECONFIG> -n control get secrets vault-secrets -o json | jq -r '.data.key1' | base64 -D)"