Config validation for OpenBao and simplify init operation

Author: cb-github-robot

docker-compose.yaml

@@ -11,7 +11,7 @@ x-default-healthcheck: &default-healthcheck
 services:
   # CB-Tumblebug
   cb-tumblebug:
-    image: cloudbaristaorg/cb-tumblebug:0.12.24
+    image: cloudbaristaorg/cb-tumblebug:0.12.25
     container_name: cb-tumblebug
     build:
       context: .
@@ -148,7 +148,7 @@ services:
 
   # CB-Spider
   cb-spider:
-    image: cloudbaristaorg/cb-spider:0.12.33
+    image: cloudbaristaorg/cb-spider:0.12.35
     container_name: cb-spider
     # build:
     #   context: ../cb-spider
@@ -179,7 +179,7 @@ services:
   # CB-MapUI
   # This is the Map-based client for CB-Tumblebug.
   cb-mapui:
-    image: cloudbaristaorg/cb-mapui:0.12.48
+    image: cloudbaristaorg/cb-mapui:0.12.50
     container_name: cb-mapui
     # build:
     #   context: ../cb-mapui

init/init.py

@@ -400,6 +400,62 @@ def get_decryption_key():
             sys.exit(1)
 
 
+# Preflight: verify the OpenBao credential store is usable by CB-Tumblebug.
+# Credentials are also stored in OpenBao for direct CSP API calls; if OpenBao is
+# misconfigured (missing VAULT_TOKEN/VAULT_ADDR, sealed, unreachable), credential
+# registration would silently skip that step — surface it to the user up front.
+def check_openbao_status():
+    try:
+        resp = requests.get(f"http://{TUMBLEBUG_SERVER}/tumblebug/credential/openbaoStatus", headers=HEADERS, timeout=10)
+        if resp.status_code == 404:
+            # Older CB-Tumblebug without this endpoint — skip the preflight quietly.
+            return {"available": None}
+        resp.raise_for_status()
+        return resp.json()
+    except requests.RequestException as e:
+        return {"available": False, "message": f"could not query OpenBao status from CB-Tumblebug: {e}"}
+
+
+def print_openbao_warning(status):
+    print(Fore.RED + "\n⚠ OpenBao credential store is NOT available to CB-Tumblebug")
+    print(Fore.YELLOW + f"  Reason: {status.get('message', 'unknown')}")
+    print(Fore.YELLOW + f"  VAULT_ADDR: {status.get('vaultAddr', '(unknown)')}")
+
+    # Show VAULT_TOKEN validity only when it was actually verifiable:
+    # "set" alone would read as "valid" and mislead (e.g., a wrong token is set).
+    reachable = status.get("reachable", False)
+    initialized = status.get("initialized", False)
+    sealed = status.get("sealed", True)
+    token_checkable = reachable and initialized and not sealed
+    if not status.get("vaultTokenSet", False):
+        print(Fore.YELLOW + "  VAULT_TOKEN: not set")
+    elif token_checkable and not status.get("tokenValid", False):
+        print(Fore.YELLOW + "  VAULT_TOKEN: set, but INVALID (rejected by OpenBao)")
+
+    print(Fore.YELLOW + "  Impact: CB-Tumblebug features will not fully work.")
+    if not reachable:
+        print(Fore.YELLOW + "  Fix: start OpenBao and services: make up")
+    elif not initialized:
+        print(Fore.YELLOW + "  Fix: initialize OpenBao: make init-openbao, then restart services: make up")
+    elif sealed:
+        print(Fore.YELLOW + "  Fix: unseal OpenBao: make unseal")
+    else:
+        # Token missing or invalid — make up restores it from init/openbao/secrets/openbao-init.json.
+        print(Fore.YELLOW + "  Fix: set VAULT_TOKEN= (empty) in .env, then run: make up")
+
+
+if run_credentials:
+    openbao_status = check_openbao_status()
+    if openbao_status.get("available") is True:
+        print(Fore.GREEN + "OpenBao credential store is available.\n")
+    elif openbao_status.get("available") is False:
+        print_openbao_warning(openbao_status)
+        print(Fore.RED + "Initialization aborted. Fix the OpenBao configuration and re-run: make init")
+        sys.exit(1)
+    else:
+        print(Fore.YELLOW + "OpenBao status check not supported by this CB-Tumblebug version; skipping preflight.\n")
+
+
 # Function to encrypt credentials using AES and RSA public key
 def encrypt_credential_value_with_publickey(public_key_pem, credentials):
     public_key = RSA.import_key(public_key_pem)
@@ -468,11 +524,22 @@ def register_credential(holder_name, provider, credentials):
 
 
 # Function to print formatted credential information
+# Collects per-credential OpenBao registration failures for the final summary.
+openbao_issues = []
+
+
 def print_credential_info(response):
     if "credentialName" in response and "credentialHolder" in response:
         # Print credential name and holder in bold
         print(Fore.YELLOW + f"\n{response['credentialName'].upper()} (holder: {response['credentialHolder']})" + Style.RESET_ALL)
 
+    # Collect OpenBao registration failures for the final summary only.
+    # OpenBao problems are global (sealed, unreachable, bad token), so a per-CSP
+    # line would just repeat the same root cause once per provider.
+    openbao_status = response.get("openBaoStatus", "")
+    if openbao_status and not openbao_status.startswith("registered"):
+        openbao_issues.append(openbao_status)
+
     if "allConnections" in response and "connectionconfig" in response["allConnections"]:
         # Print the explanation line with icons
         print(
@@ -1009,4 +1076,21 @@ def load_resources():
     except Exception as e:
         print(Fore.YELLOW + f"\n[Warning] Could not notify initialization completion: {e}")
 
-    print(Fore.YELLOW + f"\nThe system is ready to use.")
+    # Re-check OpenBao at the end so the final message reflects the actual state:
+    # declaring "ready to use" while the credential store is broken is misleading.
+    final_openbao = check_openbao_status() if run_credentials else {"available": None}
+    if final_openbao.get("available") is False or openbao_issues:
+        print(Fore.YELLOW + "\nThe system is ready to use, EXCEPT the OpenBao credential store:")
+        if final_openbao.get("available") is False:
+            print(Fore.RED + f"  - {final_openbao.get('message', 'unavailable')}")
+        if openbao_issues:
+            # OpenBao problems are global — show the count and deduplicated
+            # root cause(s), not one line per CSP.
+            print(Fore.RED + f"  - {len(openbao_issues)} credential(s) were NOT stored in OpenBao:")
+            unique_reasons = sorted(set(" ".join(issue.split()) for issue in openbao_issues))
+            for reason in unique_reasons[:3]:
+                print(Fore.RED + f"      {reason[:200]}")
+        print(Fore.YELLOW + "  Direct CSP API features of CB-Tumblebug will not work until this is resolved.")
+        print(Fore.YELLOW + "  Fix the configuration (see the OpenBao warning above) and re-run: make init")
+    else:
+        print(Fore.YELLOW + "\nThe system is ready to use.")

init/multi-init.sh

@@ -11,22 +11,24 @@ read -s -p "Enter the password for credentials.yaml.enc: " MULTI_INIT_PWD
 echo ""
 export MULTI_INIT_PWD
 
-# 1. OpenBao
-if [ -f "$SCRIPT_DIR/openbao/openbao-register-creds.sh" ]; then
-    OPENBAO_SH="$SCRIPT_DIR/openbao/openbao-register-creds.sh"
-elif [ -f "$SCRIPT_DIR/../../openbao/openbao-register-creds.sh" ]; then
-    # When executed within cm-beetle
-    OPENBAO_SH="$SCRIPT_DIR/../../openbao/openbao-register-creds.sh"
-else
-    echo "Error: Cannot find openbao-register-creds.sh"
-    exit 1
-fi
-
-echo ""
-echo "Step 1. Registering credentials to OpenBao..."
-chmod +x "$OPENBAO_SH" 2>/dev/null || true
-bash "$OPENBAO_SH"
-if [ $? -ne 0 ]; then exit 1; fi
+# 1. Step 1 script execution code is deprecated (to be removed) for operational simplicity:
+#    CB-Tumblebug server registers credentials to OpenBao automatically during Step 2.
+#
+# if [ -f "$SCRIPT_DIR/openbao/openbao-register-creds.sh" ]; then
+#     OPENBAO_SH="$SCRIPT_DIR/openbao/openbao-register-creds.sh"
+# elif [ -f "$SCRIPT_DIR/../../openbao/openbao-register-creds.sh" ]; then
+#     # When executed within cm-beetle
+#     OPENBAO_SH="$SCRIPT_DIR/../../openbao/openbao-register-creds.sh"
+# else
+#     echo "Error: Cannot find openbao-register-creds.sh"
+#     exit 1
+# fi
+#
+# echo ""
+# echo "Step 1. Registering credentials to OpenBao..."
+# chmod +x "$OPENBAO_SH" 2>/dev/null || true
+# bash "$OPENBAO_SH"
+# if [ $? -ne 0 ]; then exit 1; fi
 
 # 2. Tumblebug
 if [ -f "$SCRIPT_DIR/init.sh" ]; then

init/openbao/openbao-init.sh

@@ -109,8 +109,23 @@ done
 INIT_STATUS=$(curl -sf "${VAULT_ADDR}/v1/sys/seal-status" | grep -o '"initialized":[a-z]*' | cut -d: -f2)
 if [ "$INIT_STATUS" = "true" ]; then
     echo -e "${YELLOW}[openbao-init]${NC} OpenBao is already initialized."
-    echo "  If you need to re-initialize, destroy the volume first:"
-    echo "    docker compose down -v"
+    # Restore VAULT_TOKEN into .env from the saved init output when possible —
+    # covers the case where .env was recreated or its VAULT_TOKEN was emptied.
+    if [ -f "$INIT_OUTPUT" ]; then
+        ROOT_TOKEN=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["root_token"])' "$INIT_OUTPUT" 2>/dev/null || true)
+        if [ -n "${ROOT_TOKEN:-}" ]; then
+            if grep -q "^VAULT_TOKEN=" "${ENV_FILE}"; then
+                sed -i "s|^VAULT_TOKEN=.*|VAULT_TOKEN=${ROOT_TOKEN}|" "${ENV_FILE}"
+            else
+                echo "VAULT_TOKEN=${ROOT_TOKEN}" >> "${ENV_FILE}"
+            fi
+            echo -e "${GREEN}[openbao-init]${NC} Restored VAULT_TOKEN in ${ENV_FILE} from ${INIT_OUTPUT}"
+        fi
+    else
+        echo -e "${RED}[openbao-init]${NC} Cannot restore VAULT_TOKEN: ${INIT_OUTPUT} not found."
+        echo "  If the token is lost, reset OpenBao (destroys stored secrets):"
+        echo "    docker compose down -v"
+    fi
     exit 0
 fi
 

src/core/common/utility.go

@@ -1018,15 +1018,32 @@ func RegisterCredential(req model.CredentialReq) (model.CredentialInfo, error) {
 	}
 	//PrintJsonPretty(callResult)
 
-	// Register credentials in OpenBao for runtime CSP access (non-fatal: warn and continue if unavailable)
-	if model.VaultToken != "" {
+	// Register credentials in OpenBao for runtime CSP access (non-fatal: warn and
+	// continue if unavailable). The outcome is reported in the response via
+	// OpenBaoStatus so init tooling can surface silent failures to the user —
+	// without OpenBao, direct CSP API features cannot access this credential.
+	if model.VaultToken == "" {
+		callResult.OpenBaoStatus = "skipped: VAULT_TOKEN is not set in the cb-tumblebug environment; credential NOT stored in OpenBao"
+		log.Warn().Msgf("OpenBao registration skipped (VAULT_TOKEN not set): provider=%s holder=%s", req.ProviderName, req.CredentialHolder)
+	} else {
+		// Bound the OpenBao calls so a slow/unreachable OpenBao cannot stall
+		// credential registration for long (write + placeholder sweep).
+		openBaoCtx, openBaoCancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer openBaoCancel()
+
 		secretPath := csp.BuildSecretPathForHolder(req.CredentialHolder, req.ProviderName)
 		secretData := csp.ApplyCredentialKeyMap(req.ProviderName, decryptedKeyValueList)
-		if err := csp.WriteOpenBaoSecret(context.Background(), secretPath, secretData); err != nil {
+		if err := csp.WriteOpenBaoSecret(openBaoCtx, secretPath, secretData); err != nil {
+			callResult.OpenBaoStatus = fmt.Sprintf("failed: %v; credential NOT stored in OpenBao", err)
 			log.Warn().Err(err).Msgf("Failed to register credential in OpenBao (non-fatal): provider=%s holder=%s", req.ProviderName, req.CredentialHolder)
 		} else {
+			callResult.OpenBaoStatus = "registered at " + secretPath
 			log.Info().Msgf("Registered credential in OpenBao: path=%s", secretPath)
 		}
+		// Ensure every known CSP has at least a placeholder secret so consumers
+		// that read all CSP paths (e.g. mc-terrarium's tofu plan) don't hard-fail
+		// on providers without credentials. CAS-protected: never overwrites.
+		csp.EnsurePlaceholderCredentialSecrets(openBaoCtx)
 	}
 
 	callResult.CredentialHolder = req.CredentialHolder