11#! /bin/bash
22
3- # Vault Secrets Storage Script
3+ # Vault Secrets Storage Script (No Decryption)
44# This script stores LLM and embedding credentials in HashiCorp Vault
5+ # WITHOUT decryption - uses raw values as received
56
67set -e # Exit on any error
78
89# Configuration
9- VAULT_ADDR=" ${VAULT_ADDR:- http:// vault: 8200} "
10- VAULT_TOKEN_FILE=" /agent/out/token"
10+ # Use VAULT_AGENT_URL which points to vault-agent-cron proxy
11+ # The agent automatically injects the authentication token
12+ VAULT_ADDR=" ${VAULT_AGENT_URL:- http:// vault-agent-cron: 8203} "
1113
1214# Logging function
1315log () {
1416 echo " [$( date ' +%Y-%m-%d %H:%M:%S' ) ] $1 "
1517}
1618
17- log " === Starting Vault Secrets Storage ==="
19+ log " === Starting Vault Secrets Storage (No Decryption) ==="
1820
1921# Debug: Print received parameters
2022log " Received parameters:"
2123log " connectionId: $connectionId "
2224log " llmPlatform: $llmPlatform "
2325log " llmModel: $llmModel "
2426log " deploymentEnvironment: $deploymentEnvironment "
27+ log " Vault Address: $VAULT_ADDR "
2528
26- # Read vault token
27- if [ ! -f " $VAULT_TOKEN_FILE " ]; then
28- log " ERROR: Vault token file not found at $VAULT_TOKEN_FILE "
29- exit 1
30- fi
31-
32- VAULT_TOKEN=$( cat " $VAULT_TOKEN_FILE " )
33- if [ -z " $VAULT_TOKEN " ]; then
34- log " ERROR: Vault token is empty"
35- exit 1
36- fi
37-
38- log " Vault token loaded successfully"
29+ # Note: No token required - vault agent proxy automatically injects authentication
3930
4031# Function to determine platform name
4132get_platform_name () {
@@ -113,7 +104,9 @@ store_aws_llm_secrets() {
113104 local vault_path=$1
114105 local model=$( get_model_name)
115106
116- log " Storing AWS LLM secrets..."
107+ log " Storing AWS LLM secrets (raw values)..."
108+
109+ # Use raw values directly (no decryption)
117110
118111 # Build JSON payload
119112 local json_payload=$( cat << EOF
137130 log " API URL: $VAULT_ADDR /v1/$api_path "
138131
139132 # Execute HTTP API call
133+ # No X-Vault-Token header needed - vault agent proxy auto-injects it
140134 local response=$( curl -s -w " HTTPSTATUS:%{http_code}" \
141135 -X POST \
142- -H " X-Vault-Token: $VAULT_TOKEN " \
143136 -H " Content-Type: application/json" \
144137 -d " $json_payload " \
145138 " $VAULT_ADDR /v1/$api_path " )
@@ -161,7 +154,9 @@ store_azure_llm_secrets() {
161154 local vault_path=$1
162155 local model=$( get_model_name)
163156
164- log " Storing Azure LLM secrets..."
157+ log " Storing Azure LLM secrets (raw values)..."
158+
159+ # Use raw values directly (no decryption)
165160
166161 # Build JSON payload
167162 local json_payload=$( cat << EOF
187182 log " API URL: $VAULT_ADDR /v1/$api_path "
188183
189184 # Execute HTTP API call
185+ # No X-Vault-Token header needed - vault agent proxy auto-injects it
190186 local response=$( curl -s -w " HTTPSTATUS:%{http_code}" \
191187 -X POST \
192- -H " X-Vault-Token: $VAULT_TOKEN " \
193188 -H " Content-Type: application/json" \
194189 -d " $json_payload " \
195190 " $VAULT_ADDR /v1/$api_path " )
210205store_aws_embedding_secrets () {
211206 local vault_path=$1
212207
213- log " Storing AWS embedding secrets..."
208+ log " Storing AWS embedding secrets (raw values)..."
209+
210+ # Use raw values directly (no decryption)
214211
215212 # Build JSON payload
216213 local json_payload=$( cat << EOF
234231 log " API URL: $VAULT_ADDR /v1/$api_path "
235232
236233 # Execute HTTP API call
234+ # No X-Vault-Token header needed - vault agent proxy auto-injects it
237235 local response=$( curl -s -w " HTTPSTATUS:%{http_code}" \
238236 -X POST \
239- -H " X-Vault-Token: $VAULT_TOKEN " \
240237 -H " Content-Type: application/json" \
241238 -d " $json_payload " \
242239 " $VAULT_ADDR /v1/$api_path " )
257254store_azure_embedding_secrets () {
258255 local vault_path=$1
259256
260- log " Storing Azure embedding secrets..."
257+ log " Storing Azure embedding secrets (raw values)..."
258+
259+ # Use raw values directly (no decryption)
261260
262261 # Build JSON payload
263262 local json_payload=$( cat << EOF
283282 log " API URL: $VAULT_ADDR /v1/$api_path "
284283
285284 # Execute HTTP API call
285+ # No X-Vault-Token header needed - vault agent proxy auto-injects it
286286 local response=$( curl -s -w " HTTPSTATUS:%{http_code}" \
287287 -X POST \
288- -H " X-Vault-Token: $VAULT_TOKEN " \
289288 -H " Content-Type: application/json" \
290289 -d " $json_payload " \
291290 " $VAULT_ADDR /v1/$api_path " )
317316fi
318317
319318log " === Vault secrets storage completed successfully ==="
320-
0 commit comments