Vault setup

OpenBao auto-init produces unseal keys in a sidecar volume. Capture them to 1Password, delete the on-disk copy, then write the static creds.

Fetch unseal keys → 1Password

op item get --vault "HomeLab" "K8s Homelab Vault" --format json \
  | jq --arg new_value "$(kubectl exec -n openbao openbao-0 -c vault-autoinit \
                          -- cat /vault/init-token/cluster-keys.json \
                        | jq '.' | sed '1s/^/```json\n/;$s/$/\n```/')" \
       '.fields |= map(if .id == "notesPlain" then .value = $new_value else . end)' \
  | op item edit "K8s Homelab Vault" --vault "HomeLab" 2>&1 > /dev/null

Then delete the on-disk copy:

kubectl exec -n openbao openbao-0 -c vault-autoinit -- rm /vault/init-token/cluster-keys.json

Set static credentials

export VAULT_TOKEN=$(op item get --vault "HomeLab" "K8s Homelab Vault" --format json \
  | jq -r '.fields[] | select(.id == "notesPlain") | .value' \
  | sed 's/^```json[[:space:]]*//;s/[[:space:]]*```$//' \
  | jq -r '.root_token')
export VAULT_ADDR=https://vault.services.homelab.muehlena.de
# FIXME: remove once cert pinning is sorted
export VAULT_SKIP_VERIFY=true

./scripts/set-vault-static-creds.bash

Re-run the k8s setup script

Idempotent — safe to re-run if a piece needs to be retried:

kubectl exec vault-0 -n vault -- /bin/sh -c \
  "VAULT_TOKEN=$(op item get --vault "HomeLab" "K8s Homelab Vault" --format json \
   | jq -r '.fields[] | select(.id == "notesPlain") | .value' \
   | sed 's/^```json[[:space:]]*//;s/[[:space:]]*```$//' \
   | jq -r '.root_token') /vault/userconfig/scripts/vault-k8s-setup.sh"

Combine raw unseal-key files into a JSON array

If you ever have the individual key files on disk and want a single JSON array:

jq -Rn '[inputs]' < <(for f in *; do cat "$f"; echo; done)