ai-workspace-lab/xworkspace-console
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(macos): write vault bootstrap error to a readable file (diagnostic)

Browse Source 
Disable no_log on the bootstrap and dump rc/stdout/stderr to
cloud-neutral-toolkit/vault-bootstrap-debug.log so the real init_vault_admin.sh
error can be inspected directly instead of relying on console copy/paste.
This commit is contained in:
Haitao Pan 2026-06-18 12:32:02 +00:00
parent c5c4ecf58a
commit b6d830d7d0
1 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
scripts/setup-ai-workspace-all-in-one.sh
View File

@ -1174,16 +1174,17 @@ if boot_old in tasks_text and boot_new not in tasks_text:
tasks_text = tasks_text.replace(boot_old, boot_new, 1) tasks_text = tasks_text.replace(boot_old, boot_new, 1)
# 2c) DIAGNOSTIC (macOS): the bootstrap runs under no_log so its real failure is # 2c) DIAGNOSTIC (macOS): the bootstrap runs under no_log so its real failure is
# hidden. Capture the result (keeping no_log on the script so the password in the # hidden. Temporarily disable no_log, capture the result, and write rc/stdout/
# command args stays censored) and print only stdout/stderr — which carry no # stderr to a file under the user's cloud-neutral-toolkit folder so the actual
# secrets — then assert, so the actual error surfaces instead of a censored blob. # init_vault_admin.sh error can be inspected directly. Still asserts so the run
# fails clearly. (Diagnostic only; to be removed once root-caused.)
diag_anchor = ( diag_anchor = (
" no_log: true\n" " no_log: true\n"
" when:\n" " when:\n"
" - not ansible_check_mode\n" " - not ansible_check_mode\n"
) )
diag_new = ( diag_new = (
" no_log: true\n" " no_log: false\n"
" register: vault_admin_bootstrap_result\n" " register: vault_admin_bootstrap_result\n"
" failed_when: false\n" " failed_when: false\n"
" when:\n" " when:\n"
@ -1201,11 +1202,24 @@ diag_tasks = (
" when:\n" " when:\n"
" - ansible_os_family == 'Darwin'\n" " - ansible_os_family == 'Darwin'\n"
" - vault_admin_bootstrap_result is defined\n" " - vault_admin_bootstrap_result is defined\n"
"\n- name: Write Vault bootstrap diagnostics to file (macOS)\n"
" ansible.builtin.copy:\n"
" dest: \"/Users/shenlan/workspaces/cloud-neutral-toolkit/vault-bootstrap-debug.log\"\n"
" content: |\n"
" rc={{ vault_admin_bootstrap_result.rc | default('n/a') }}\n"
" ===== STDOUT =====\n"
" {{ vault_admin_bootstrap_result.stdout | default('') }}\n"
" ===== STDERR =====\n"
" {{ vault_admin_bootstrap_result.stderr | default('') }}\n"
" when:\n"
" - ansible_os_family == 'Darwin'\n"
" - vault_admin_bootstrap_result is defined\n"
" ignore_errors: true\n"
"\n- name: Fail when Vault admin bootstrap failed (macOS)\n" "\n- name: Fail when Vault admin bootstrap failed (macOS)\n"
" ansible.builtin.assert:\n" " ansible.builtin.assert:\n"
" that:\n" " that:\n"
" - (vault_admin_bootstrap_result.rc | default(1)) == 0\n" " - (vault_admin_bootstrap_result.rc | default(1)) == 0\n"
" fail_msg: \"vault admin bootstrap failed; see diagnostics above\"\n" " fail_msg: \"vault admin bootstrap failed; see diagnostics above / vault-bootstrap-debug.log\"\n"
" when:\n" " when:\n"
" - ansible_os_family == 'Darwin'\n" " - ansible_os_family == 'Darwin'\n"
" - vault_admin_bootstrap_result is defined\n" " - vault_admin_bootstrap_result is defined\n"