k exec -it -n portal-system sts/vault -- sh
### START IN CONTAINER
vault login

policy_name=admin-policy

cat > /tmp/${policy_name}.hcl <<EOF
path "*" {
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}
EOF

vault policy write ${policy_name} /tmp/${policy_name}.hcl

k exec -it -n portal-system sts/vault -- sh
### START IN CONTAINER
vault login

if vault auth list | grep -q "userpass/"; then
  echo "[SKIP] userpass already enabled"
else
  vault auth enable userpass
  vault auth tune -listing-visibility=unauth userpass/
fi

user_name=admin
  user_password=
  policy_name=admin-policy

  vault write auth/userpass/users/${user_name} \
      password="${user_password}" \
      policies="${policy_name}"

k exec -it -n portal-system sts/vault -- sh
### START IN CONTAINER
vault login

vault auth enable kubernetes
vault write auth/kubernetes/config \
    token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
    kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
    kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

test_pod=lovely-octopus
    TOKEN=$(kubectl exec -n deploy-system $test_pod -c vault-agent-init -- cat /var/run/secrets/kubernetes.io/serviceaccount/token)

    echo $TOKEN | cut -d'.' -f2 | base64 -d 2>/dev/null | jq .

k exec -it -n portal-system sts/vault -- sh
### START IN CONTAINER
vault login

role_name=deploy-admin-role
policy_name=admin-policy
kube_sa=deploy-admin
kube_sa_ns=deploy-system

vault write auth/kubernetes/role/${role_name} \
    bound_service_account_names=${kube_sa} \
    bound_service_account_namespaces=${kube_sa_ns} \
    policies=${policy_name} \
    ttl=24h \
    audience="https://kubernetes.default.svc.cluster.local"

spec:
  template:
    metadata:
      annotations:
      labels:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "deploy-admin-role"
        vault.hashicorp.com/agent-inject-secret-common: "secret/mgt/pipelines/common"
        vault.hashicorp.com/agent-inject-template-common: |
          {{- with secret "secret/mgt/pipelines/common" -}}
          export image_registry_id="{{ .Data.data.username }}"
          export image_registry_pw="{{ .Data.data.password }}"
          {{- end -}}
		    vault.hashicorp.com/agent-inject-secret-exception: "secret/mgt/pipelines/build1"
		    vault.hashicorp.com/agent-inject-template-exception: |
		      {{- with secret "secret/mgt/pipelines/build1" -}}
		      export NPM_VERSION="{{ .Data.data.version }}"
		      {{- end -}}

source /vault/secrets/common
source /vault/secrets/exception

k exec -it -n portal-system sts/vault -- cat /var/run/secrets/kubernetes.io/serviceaccount/token

#k8s cluster
safe env

kubectl exec -n vault sva-vault-manager-0 -- cat /mnt/data/cluster_keys.json | grep -oP --color=never '(?<="root_token":")[^"]*'

k get secrets -n vault  vault-init -o jsonpath="{.data.VAULT_INIT_JSON}" | base64 -d
>>>
# root_token
{
  "unseal_keys_b64": [
    "KFaqIfd2hMZu/3Av9992M7C8/V6Bo51m/hrdXR4yRktb",
    "Ys6aCMwmiYBbUoaI4/wKJwsAyWXz6JGaHuTFIAHO7q7T",
    "R55MSYKIaGSiqZUduy1n5hkCeNlN9q5JIFTZn52Rihdm",
    "zNuOvfN0dGd2dxeaODziMKXFv8I85pqxtIiL5OQ1vd0N",
    "s1834/4Kxp3GPbf3rEMuNmlt1g9lhRlvBKLd3121U16v"
  ],
  "unseal_keys_hex": [
    "2856aa21f77684c66eff702ff7df7633b0bcfd5e81a39d66fe1add5d1e32464b5b",
    "62ce9a08cc2689805b528688e3fc0a270b00c965f3e8919a1ee4c52001ceeeaed3",
    "479e4c4982886864a2a9951dbb2d67e6190278d94df6ae492054d99f9d918a1766",
    "ccdb8ebdf37474677677179a383ce230a5c5bfc23ce69ab1b4888be4e435bddd0d",
    "b35f37e3fe0ac69dc63db7f7ac432e36696dd60f6585196f04a2dddf5db5535eaf"
  ],
  "unseal_shares": 5,
  "unseal_threshold": 3,
  "recovery_keys_b64": [],<<<
  "recovery_keys_hex": [],
  "recovery_keys_shares": 0,
  "recovery_keys_threshold": 0,
  "root_token": "hvs.IlRy460I1duY0mEDJPiBzgfK"
}
<<<