feat(secrets): with-vault.sh --env (same environment as ./setup) #228
Loading…
Reference in a new issue
No description provided.
Delete branch "jfraeys/feat/with-vault-env-flag"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The OVH rehearsal's services play stopped at traefik: 'TF_VAR_cloudflare_api_token is required'. The role reads it with lookup('env', ...); ./setup exports the vault's TF_VAR_* and related secrets through common_vault_load_env, but with-vault.sh only decrypts vault.yml for include_vars. --env calls common_vault_load_env before running the command. Opt-in: the default behavior and all existing callers are unchanged.
Checked: test-with-vault-env.sh (5 cases with a stub library, in lint.yml); against the real vault from a worktree, with --env the Cloudflare/deSEC tokens, ssh_port and OBJECT_STORAGE key are set in the command's environment, without it the token is unset.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
A direct ansible-playbook run through with-vault.sh had vault.yml for include_vars but none of the TF_VAR_* environment that ./setup exports; traefik reads its Cloudflare token with lookup('env', 'TF_VAR_cloudflare_api_token') and failed on the OVH rehearsal. --env is opt-in; the default is unchanged. Test: test-with-vault-env.sh (stub vault library), plus a manual check against the real vault (tokens set with --env, unset without). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ