sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

issue-cert: probe both smallstep password locations (secrets/password on older images)

Browse Source
This commit is contained in:
Audiobuzz
2026-07-12 06:05:40 +00:00
parent dd3a672a82
commit 4fe6a5ae16
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serving/audit-collector/issue-cert.sh
+7 -1
View File
@@ -31,11 +31,17 @@ cd "$BENCH_DIR"
CA_PORT=${CA_PORT:-8443} CA_PORT=${CA_PORT:-8443}
CA_CONNECT=${CA_CONNECT:-localhost} # see bootstrap.sh: SAN-valid AND resolvable CA_CONNECT=${CA_CONNECT:-localhost} # see bootstrap.sh: SAN-valid AND resolvable
CA_URL="https://${CA_CONNECT}:${CA_PORT}" CA_URL="https://${CA_CONNECT}:${CA_PORT}"
CONTAINER_PW="/home/step/password" # bootstrap.sh: pki/stepca/password in-container
step() { docker compose exec -T step-ca step "$@"; } step() { docker compose exec -T step-ca step "$@"; }
incca() { docker compose exec -T step-ca "$@"; } incca() { docker compose exec -T step-ca "$@"; }
# CA/provisioner password file, as seen INSIDE the container. Location varies by
# smallstep image version (newer: $STEPPATH/password, older: $STEPPATH/secrets/
# password) — probe both, like bootstrap.sh does.
# shellcheck disable=SC2016 # $f expands in the CONTAINER's sh, not here
CONTAINER_PW=$(incca sh -c 'for f in /home/step/password /home/step/secrets/password; do [ -f "$f" ] && { echo "$f"; exit 0; }; done; exit 1') \
|| { echo "ERROR: no CA password file in the step-ca container (/home/step{,/secrets}/password) — did the CA auto-init? Check: docker compose logs step-ca" >&2; exit 1; }
echo "==> issuing audit-collector cert (CN/SAN: $AUDIT_HOST) from the fleet CA" echo "==> issuing audit-collector cert (CN/SAN: $AUDIT_HOST) from the fleet CA"
incca mkdir -p /export/audit incca mkdir -p /export/audit
step ca certificate "$AUDIT_HOST" \ step ca certificate "$AUDIT_HOST" \