Vault Password Rotation - Linux User

rotate.sh

#!/bin/bash

source /home/$USER/.bashrc

echo "Renew lease for"

curl -sS --fail -X POST -H "X-Vault-Token: $VAULT_TOKEN" ${VAULT_ADDR}/v1/auth/token/renew-self | jq .auth.lease_duration
retval=$?
if [[ $retval -ne 0 ]]; then
  echo "Error renewing Vault token lease."
fi

ROTATION_KV="rotation-kv"

echo "Rotating $USER password"

echo "{\"data\":{\"password\":\"$(openssl rand -rand /etc/machine-id:/etc/ssl/certs/ca-certificates.crt -base64 33)\"}}" \
| curl -sX POST -H "X-Vault-Token: $VAULT_TOKEN" ${VAULT_ADDR}/v1/${ROTATION_KV}/data/$(hostname) -d @- | jq .data.version || echo "fail"

NEWPASSWORD=$(curl -sX GET -H "X-Vault-Token: $VAULT_TOKEN" ${VAULT_ADDR}/v1/${ROTATION_KV}/data/$(hostname) | jq .data.data.password | sed 's/"//g')

echo  "$USER:$NEWPASSWORD" | sudo chpasswd