tech-debt: tools/vault-import.sh uses hardcoded secret/ KV mount #910

New issue

Closed

opened 2026-04-16 19:48:19 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-16 19:48:19 +00:00

Collaborator

Flagged by AI reviewer in PR #909.

Problem

tools/vault-import.sh still uses hardcoded secret/data/${path} for its curl-based KV write (lines 149, 151, 162, 166, 170). The rest of the codebase was migrated to the configurable VAULT_KV_MOUNT variable (defaulting to kv) via PR #909. Any deployment with kv/ as its KV mount will see 403/404 failures when vault-import.sh runs.

Fix

Either:

Refactor the write in vault-import.sh to call hvault_kv_put (which now respects VAULT_KV_MOUNT), or
Replace the hardcoded secret/data reference with ${VAULT_KV_MOUNT:-kv}/data matching the convention in lib/hvault.sh.

Auto-created from AI review

Affected files

tools/vault-import.sh (lines 149, 151, 162, 166, 170 — hardcoded secret/data references)
lib/hvault.sh (reference implementation using VAULT_KV_MOUNT)

Acceptance criteria

tools/vault-import.sh uses ${VAULT_KV_MOUNT:-kv}/data (or calls hvault_kv_put) instead of hardcoded secret/data
No hardcoded secret/data path references remain in tools/vault-import.sh
Vault KV writes succeed when VAULT_KV_MOUNT=kv is set (matching the standard deployment config)
shellcheck clean

Flagged by AI reviewer in PR #909. ## Problem `tools/vault-import.sh` still uses hardcoded `secret/data/${path}` for its curl-based KV write (lines 149, 151, 162, 166, 170). The rest of the codebase was migrated to the configurable `VAULT_KV_MOUNT` variable (defaulting to `kv`) via PR #909. Any deployment with `kv/` as its KV mount will see 403/404 failures when `vault-import.sh` runs. ## Fix Either: 1. Refactor the write in `vault-import.sh` to call `hvault_kv_put` (which now respects `VAULT_KV_MOUNT`), or 2. Replace the hardcoded `secret/data` reference with `${VAULT_KV_MOUNT:-kv}/data` matching the convention in `lib/hvault.sh`. --- *Auto-created from AI review* ## Affected files - `tools/vault-import.sh` (lines 149, 151, 162, 166, 170 — hardcoded `secret/data` references) - `lib/hvault.sh` (reference implementation using `VAULT_KV_MOUNT`) ## Acceptance criteria - [ ] `tools/vault-import.sh` uses `${VAULT_KV_MOUNT:-kv}/data` (or calls `hvault_kv_put`) instead of hardcoded `secret/data` - [ ] No hardcoded `secret/data` path references remain in `tools/vault-import.sh` - [ ] Vault KV writes succeed when `VAULT_KV_MOUNT=kv` is set (matching the standard deployment config) - [ ] `shellcheck` clean