Snarp/zabbix
1
0
Fork 0
Code Issues Pull requests Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #1911 from zabbix/fix/vault_prefix

Browse source 
Fix/vault prefix
This commit is contained in:
Alexey Pustovalov 2026-06-02 16:55:27 +09:00
parent 5d97d46161
commit 616a100621
3 changed files with 79 additions and 100 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

54
templates/entrypoints/lib/mysql.sh
View file

@ -7,6 +7,7 @@
source "${ENTRYPOINT_LIBS}/logging.sh"
source "${ENTRYPOINT_LIBS}/config.sh"
source "${ENTRYPOINT_LIBS}/vault.sh"
set_mysql_cli() {
case "${DB_ENGINE}" in
@ -87,8 +88,8 @@ check_db_variables() {
error "**** Impossible to use MySQL server because of unknown Zabbix user and random 'root' password"
fi
if [ -z "${MYSQL_USER:-}" ] && [ -z "${MYSQL_ROOT_PASSWORD:-}" ] && [ "${MYSQL_ALLOW_EMPTY_PASSWORD:-}" != "true" ]; then
error "*** Impossible to use MySQL server because 'root' password is not defined and it is not empty"
if [ -z "${MYSQL_USER:-}" ] && [ -z "${MYSQL_ROOT_PASSWORD:-}" ] && [ "${MYSQL_ALLOW_EMPTY_PASSWORD:-}" != "true" ] && [ -z "${ZBX_VAULT:-}" ]; then
error "*** Impossible to use MySQL server because 'root' password is not defined, external vault is not configured and empty password is not allowed"
fi
if [ "${MYSQL_ALLOW_EMPTY_PASSWORD:-}" = "true" ] || [ -n "${MYSQL_ROOT_PASSWORD:-}" ]; then
@ -112,54 +113,6 @@ check_db_variables() {
set_mysql_cli
}
get_vault_secrets() {
local wait_timeout=5
local curl_opts=(-s -m 10 -k)
local vaultdata errors
local cyberark_opts
if [ -z "${ZBX_VAULTURL:-}" ] || [ -z "${ZBX_VAULTPREFIX:-}" ] || [ -z "${ZBX_VAULTDBPATH:-}" ]; then
error "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
fi
local vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
if [ "${ZBX_VAULT:-}" = "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
info "**** Vault is not available. Waiting ${wait_timeout} seconds... ****"
sleep "$wait_timeout"
done
errors="$(printf '%s' "$vaultdata" | jq -r '.errors // empty')"
if [ -n "${errors}" ]; then
error "Error getting secrets from vault: $errors"
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT:-}" = "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE:-}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata="$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url")"; do
info "**** Vault is not available. Waiting ${wait_timeout} seconds... ****"
sleep "$wait_timeout"
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
error "Error getting secrets from vault: $errors"
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
error "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
fi
}
check_db_connect() {
local use_vault="${1:-false}"
local wait_timeout=5
@ -188,7 +141,6 @@ check_db_connect() {
unset DB_SERVER_ZBX_PASS
info "***** Connecting to vault... ******"
info "***** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi

51
templates/entrypoints/lib/pgsql.sh
View file

@ -3,6 +3,8 @@
# Enable PostgreSQL timescaleDB feature
: "${ENABLE_TIMESCALEDB:=false}"
source "${ENTRYPOINT_LIBS}/vault.sh"
set_pg_env() {
[ -n "${DB_SERVER_ZBX_PASS:-}" ] && export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
@ -50,54 +52,6 @@ check_db_variables() {
[ -n "${DB_SERVER_HOST}" ] && psql_connect_args+=(--host "${DB_SERVER_HOST}")
}
get_vault_secrets() {
local wait_timeout=5
local curl_opts=(-s -m 10 -k)
local vaultdata errors
local cyberark_opts
if [ -z "${ZBX_VAULTURL:-}" ] || [ -z "${ZBX_VAULTPREFIX:-}" ] || [ -z "${ZBX_VAULTDBPATH:-}" ]; then
error "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
fi
local vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
if [ "${ZBX_VAULT:-}" = "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
info "**** Vault is not available. Waiting ${wait_timeout} seconds... ****"
sleep "$wait_timeout"
done
errors="$(printf '%s' "$vaultdata" | jq -r '.errors // empty')"
if [ -n "${errors}" ]; then
error "Error getting secrets from vault: $errors"
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT:-}" = "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE:-}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata="$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url")"; do
info "**** Vault is not available. Waiting ${wait_timeout} seconds... ****"
sleep "$wait_timeout"
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
error "Error getting secrets from vault: $errors"
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
error "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
fi
}
check_db_connect() {
local use_vault="${1:-false}"
local wait_timeout=5
@ -123,7 +77,6 @@ check_db_connect() {
unset DB_SERVER_ZBX_PASS
info "***** Connecting to vault... ******"
info "***** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi

74
templates/entrypoints/lib/vault.sh Normal file
View file

@ -0,0 +1,74 @@
# shellcheck shell=bash
get_vault_secrets() {
local wait_timeout=5
local vaultdata errors
local cyberark_opts
if [ -z "${ZBX_VAULTURL:-}" ] || [ -z "${ZBX_VAULTDBPATH:-}" ]; then
error "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL and ZBX_VAULTDBPATH must be set"
fi
# Sanitize input
ZBX_VAULTURL="${ZBX_VAULTURL%/}"
ZBX_VAULTDBPATH="${ZBX_VAULTDBPATH#/}"
ZBX_VAULTDBPATH="${ZBX_VAULTDBPATH%/}"
if [ "${ZBX_VAULT:-}" = "HashiCorp" ]; then
if [ -z "${ZBX_VAULTPREFIX:-}" ]; then
ZBX_VAULTPREFIX="v1/${ZBX_VAULTDBPATH%/*}/data"
ZBX_VAULTDBPATH="${ZBX_VAULTDBPATH##*/}"
else
ZBX_VAULTPREFIX="${ZBX_VAULTPREFIX#/}"
ZBX_VAULTPREFIX="${ZBX_VAULTPREFIX%/}"
fi
local vault_url="${ZBX_VAULTURL}/${ZBX_VAULTPREFIX}/${ZBX_VAULTDBPATH}"
local curl_opts=(-s -m 10 -k)
info "***** VAULT URL: $vault_url"
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
info "**** Vault is not available. Waiting ${wait_timeout} seconds... ****"
sleep "$wait_timeout"
done
errors="$(printf '%s' "$vaultdata" | jq -r '.errors // empty')"
if [ -n "${errors}" ]; then
error "Error getting secrets from vault: $errors"
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT:-}" = "CyberArk" ]; then
if [ -z "${ZBX_VAULTCERTFILE:-}" ] ; then
error "Missing variables! If CyberArk is used then ZBX_VAULTCERTFILE must be set"
fi
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
if [ -z "${ZBX_VAULTPREFIX:-}" ]; then
ZBX_VAULTPREFIX="AIMWebService/api/Accounts?"
else
ZBX_VAULTPREFIX="${ZBX_VAULTPREFIX#/}"
ZBX_VAULTPREFIX="${ZBX_VAULTPREFIX%/}/"
fi
local vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
local curl_opts=(-s -m 10)
info "***** VAULT URL: $vault_url"
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE:-}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
echo "FULL_URL: $vault_url"
while ! vaultdata="$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url")"; do
info "**** Vault is not available. Waiting ${wait_timeout} seconds... ****"
sleep "$wait_timeout"
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
error "Error getting secrets from vault: $errors"
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
error "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
fi
}