#!/bin/bash
# 从 /usr/cluster/vault/init.json 读取解封密钥。不要把密钥打到终端。
set -eu
export KUBECONFIG=/root/.kube/config
key=$(python3 -c 'import json; print(json.load(open("/usr/cluster/vault/init.json"))["unseal_keys_b64"][0], end="")')
kubectl -n vault exec vault-0 -- vault operator unseal "$key" >/tmp/vault-unseal.out
rm -f /tmp/vault-unseal.out
kubectl -n vault exec vault-0 -- vault status -format=json \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print("initialized", d.get("initialized"), "sealed", d.get("sealed"))'