ivanch
ce8270290d
The bitwarden-cli Deployment's startup script never set BW_SESSION when running without API-key creds (empty password branch / bw unlock --check only), so bw serve started unauthenticated and every ExternalSecret across all namespaces failed with HTTP 400 / 'Not found'. Wrap login in a function, export the session, warm the cache once, and re-login every 5m in the background loop so the session token never lapses.
105 lines
3.7 KiB
YAML
105 lines
3.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-cli
|
|
namespace: bitwarden
|
|
labels:
|
|
app.kubernetes.io/name: bitwarden-cli
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: bitwarden-cli
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: bitwarden-cli
|
|
spec:
|
|
containers:
|
|
- name: bitwarden-cli
|
|
image: ghcr.io/charlesthomas/bitwarden-cli:2026.3.0
|
|
imagePullPolicy: IfNotPresent
|
|
# Override the baked entrypoint so --disable-origin-protection is
|
|
# actually passed (it was commented out in the image's entrypoint.sh,
|
|
# which made bw serve reject all cross-pod requests -> connection refused).
|
|
command: ["/bin/bash", "-lc"]
|
|
args:
|
|
- |
|
|
set -e
|
|
bw config server "${BW_HOST}"
|
|
# Authenticate. Prefer the API key if client creds are present,
|
|
# otherwise fall back to username+password. The session is exported
|
|
# so the background loop can re-derive (and refresh) it.
|
|
login() {
|
|
if [ -n "$BW_CLIENTID" ] && [ -n "$BW_CLIENTSECRET" ]; then
|
|
echo "Using apikey to log in"
|
|
BW_SESSION=$(bw login --apikey --raw) || return 1
|
|
else
|
|
echo "Using password to log in"
|
|
BW_SESSION=$(bw login "${BW_USER}" --passwordenv BW_PASSWORD --raw) || return 1
|
|
fi
|
|
export BW_SESSION
|
|
}
|
|
login
|
|
# Warm the vault cache once at startup so bw serve has data immediately.
|
|
bw sync
|
|
bw status
|
|
# Keep the session alive: RE-LOGIN every cycle and re-sync so the on-disk
|
|
# vault cache stays warm and the session token never lapses. A loop that
|
|
# only re-ran `bw sync` with a captured session would eventually fail once
|
|
# the session expired (-> stale cache / "Not found" for changed items, or a
|
|
# full unauthenticated 400 if the initial login never happened at all).
|
|
echo "Starting periodic bw login+sync loop (every 5m)"
|
|
(
|
|
while true; do
|
|
sleep 300
|
|
login || true
|
|
echo "[$(date -u +%FT%TZ)] bw sync"
|
|
bw sync >/dev/null 2>&1 || echo "[$(date -u +%FT%TZ)] bw sync failed"
|
|
done
|
|
) &
|
|
echo 'Running `bw serve` on port 8087'
|
|
bw serve --hostname 0.0.0.0 --disable-origin-protection
|
|
env:
|
|
- name: BW_HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bitwarden-cli
|
|
key: BW_HOST
|
|
- name: BW_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bitwarden-cli
|
|
key: BW_USERNAME
|
|
- name: BW_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bitwarden-cli
|
|
key: BW_PASSWORD
|
|
ports:
|
|
- name: http
|
|
containerPort: 8087
|
|
protocol: TCP
|
|
startupProbe:
|
|
tcpSocket: { port: 8087 }
|
|
periodSeconds: 5
|
|
timeoutSeconds: 3
|
|
failureThreshold: 30
|
|
readinessProbe:
|
|
tcpSocket: { port: 8087 }
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
failureThreshold: 3
|
|
livenessProbe:
|
|
tcpSocket: { port: 8087 }
|
|
periodSeconds: 15
|
|
timeoutSeconds: 3
|
|
failureThreshold: 6
|
|
resources:
|
|
limits:
|
|
cpu: 400m
|
|
memory: 512Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|