fix(cli): keep updated install vault encrypted

cli/cmd/init_install_config.go

@@ -163,7 +163,7 @@ func AddInitInstallConfigCmd(init *cobra.Command, opts *util.GlobalOptions) {
 
 	// Postgres
 	c.cmd.Flags().StringVar(&c.Opts.PostgresMode, "postgres-mode", "", "PostgreSQL setup mode (install/external)")
-	c.cmd.Flags().StringVar(&c.Opts.PostgresServerAddress, "postgres-server", "", "PostgreSQL server hostname for install mode or address for external mode")
+	c.cmd.Flags().StringVar(&c.Opts.PostgresServerAddress, "postgres-server", "", "PostgreSQL server: primary hostname in install mode, connection address in external mode")
 	c.cmd.Flags().StringVar(&c.Opts.PostgresPrimaryIP, "postgres-primary-ip", "", "Primary PostgreSQL server IP")
 
 	// K8s
@@ -244,7 +244,7 @@ func (c *InitInstallConfigCmd) InitInstallConfig(icg installer.InstallConfigMana
 		return fmt.Errorf("failed to write config file: %w", err)
 	}
 
-	if err := icg.WriteVault(c.Opts.VaultFile, c.Opts.WithComments); err != nil {
+	if err := icg.WriteUnencryptedVault(c.Opts.VaultFile, c.Opts.WithComments); err != nil {
 		return fmt.Errorf("failed to write vault file: %w", err)
 	}
 
@@ -353,12 +353,14 @@ func (c *InitInstallConfigCmd) updateConfigFromOpts(config *files.RootConfig, va
 		config.Postgres.Mode = c.Opts.PostgresMode
 	}
 
-	postgresPrimaryHostname := determinePostgresPrimaryHostname(config.Postgres.Mode, c.Opts)
+	postgresPrimaryHostname, postgresServerAddress := determinePostgresServerConfig(
+		config.Postgres.Mode,
+		c.Opts.PostgresServerAddress,
+		c.Opts.PostgresPrimaryHostname,
+		config.Postgres.ServerAddress,
+	)
 	if c.Opts.PostgresServerAddress != "" {
-		config.Postgres.ServerAddress = c.Opts.PostgresServerAddress
-	}
-	if c.Opts.PostgresServerAddress != "" && config.Postgres.Mode == "install" {
-		config.Postgres.ServerAddress = ""
+		config.Postgres.ServerAddress = postgresServerAddress
 	}
 
 	if postgresPrimaryHostname != "" || c.Opts.PostgresPrimaryIP != "" {
@@ -564,14 +566,12 @@ func (c *InitInstallConfigCmd) updateConfigFromOpts(config *files.RootConfig, va
 	return config
 }
 
-func determinePostgresPrimaryHostname(postgresMode string, opts *InitInstallConfigOpts) string {
-	if postgresMode != "install" {
-		return opts.PostgresPrimaryHostname
+func determinePostgresServerConfig(postgresMode, postgresServer, primaryHostname, serverAddress string) (string, string) {
+	if postgresServer == "" {
+		return primaryHostname, serverAddress
 	}
-
-	if opts.PostgresServerAddress == "" {
-		return opts.PostgresPrimaryHostname
+	if postgresMode == "install" {
+		return postgresServer, ""
 	}
-
-	return opts.PostgresServerAddress
+	return primaryHostname, postgresServer
 }

cli/cmd/init_install_config_interactive_test.go

@@ -153,7 +153,7 @@ var _ = Describe("Interactive profile usage", func() {
 			mockIcg.EXPECT().ValidateInstallConfig().Return([]string{"configuration validation failed"})
 			mockIcg.EXPECT().GenerateSecrets().Return(nil)
 			mockIcg.EXPECT().WriteInstallConfig("config.yaml", false).Return(nil)
-			mockIcg.EXPECT().WriteVault("vault.yaml", false).Return(nil)
+			mockIcg.EXPECT().WriteUnencryptedVault("vault.yaml", false).Return(nil)
 
 			c := &InitInstallConfigCmd{
 				Opts: &InitInstallConfigOpts{

cli/cmd/update_install_config.go

@@ -37,6 +37,7 @@ type UpdateInstallConfigOpts struct {
 	PostgresReplicaIP       string
 	PostgresReplicaName     string
 	PostgresServerAddress   string
+	PostgresServer          string
 
 	CephNodesSubnet string
 
@@ -86,6 +87,8 @@ func AddUpdateInstallConfigCmd(update *cobra.Command, opts *util.GlobalOptions)
 			of the PostgreSQL server certificates that include that IP address.`),
 			Example: util.FormatExamples("update install-config", []csio.Example{
 				{Cmd: "--postgres-primary-ip 10.10.0.4 --config config.yaml --vault prod.vault.yaml", Desc: "Update PostgreSQL primary IP and regenerate certificates"},
+				{Cmd: "--postgres-server postgres-1 --config config.yaml --vault prod.vault.yaml", Desc: "Set the primary PostgreSQL hostname when mode is install"},
+				{Cmd: "--postgres-server db.example.com:5432 --config config.yaml --vault prod.vault.yaml", Desc: "Set the PostgreSQL connection address when mode is external"},
 				{Cmd: "--domain new.example.com --config config.yaml --vault prod.vault.yaml", Desc: "Update Codesphere domain"},
 				{Cmd: "--k8s-api-server 10.0.0.10 --config config.yaml --vault prod.vault.yaml", Desc: "Update Kubernetes API server host"},
 			}),
@@ -101,10 +104,13 @@ func AddUpdateInstallConfigCmd(update *cobra.Command, opts *util.GlobalOptions)
 
 	// PostgreSQL update flags
 	c.cmd.Flags().StringVar(&c.Opts.PostgresPrimaryIP, "postgres-primary-ip", "", "Primary PostgreSQL server IP")
-	c.cmd.Flags().StringVar(&c.Opts.PostgresPrimaryHostname, "postgres-primary-hostname", "", "Primary PostgreSQL server hostname")
+	c.cmd.Flags().StringVar(&c.Opts.PostgresPrimaryHostname, "postgres-primary-hostname", "", "Primary PostgreSQL server hostname (deprecated: use --postgres-server)")
 	c.cmd.Flags().StringVar(&c.Opts.PostgresReplicaIP, "postgres-replica-ip", "", "Replica PostgreSQL server IP")
 	c.cmd.Flags().StringVar(&c.Opts.PostgresReplicaName, "postgres-replica-name", "", "Replica PostgreSQL server name")
-	c.cmd.Flags().StringVar(&c.Opts.PostgresServerAddress, "postgres-server-address", "", "PostgreSQL server address (for external mode)")
+	c.cmd.Flags().StringVar(&c.Opts.PostgresServerAddress, "postgres-server-address", "", "External PostgreSQL connection address (deprecated: use --postgres-server)")
+	c.cmd.Flags().StringVar(&c.Opts.PostgresServer, "postgres-server", "", "PostgreSQL server: primary hostname in install mode, connection address in external mode")
+	_ = c.cmd.Flags().MarkDeprecated("postgres-primary-hostname", "use --postgres-server instead")
+	_ = c.cmd.Flags().MarkDeprecated("postgres-server-address", "use --postgres-server instead")
 
 	// Ceph update flags
 	c.cmd.Flags().StringVar(&c.Opts.CephNodesSubnet, "ceph-nodes-subnet", "", "Ceph nodes subnet")
@@ -199,16 +205,23 @@ func (c *UpdateInstallConfigCmd) applyUpdates(config *files.RootConfig, vault *f
 }
 
 func (c *UpdateInstallConfigCmd) applyPostgresUpdates(config *files.RootConfig, tracker *SecretDependencyTracker) {
-	if c.Opts.PostgresPrimaryIP != "" || c.Opts.PostgresPrimaryHostname != "" {
+	primaryHostname, serverAddress := determinePostgresServerConfig(
+		config.Postgres.Mode,
+		c.Opts.PostgresServer,
+		c.Opts.PostgresPrimaryHostname,
+		c.Opts.PostgresServerAddress,
+	)
+
+	if c.Opts.PostgresPrimaryIP != "" || primaryHostname != "" {
 		if config.Postgres.Primary != nil {
 			if c.Opts.PostgresPrimaryIP != "" && config.Postgres.Primary.IP != c.Opts.PostgresPrimaryIP {
 				log.Printf("Updating PostgreSQL primary IP: %s -> %s\n", config.Postgres.Primary.IP, c.Opts.PostgresPrimaryIP)
 				config.Postgres.Primary.IP = c.Opts.PostgresPrimaryIP
 				tracker.MarkPostgresPrimaryCertNeedsRegen()
 			}
-			if c.Opts.PostgresPrimaryHostname != "" && config.Postgres.Primary.Hostname != c.Opts.PostgresPrimaryHostname {
-				log.Printf("Updating PostgreSQL primary hostname: %s -> %s\n", config.Postgres.Primary.Hostname, c.Opts.PostgresPrimaryHostname)
-				config.Postgres.Primary.Hostname = c.Opts.PostgresPrimaryHostname
+			if primaryHostname != "" && config.Postgres.Primary.Hostname != primaryHostname {
+				log.Printf("Updating PostgreSQL primary hostname: %s -> %s\n", config.Postgres.Primary.Hostname, primaryHostname)
+				config.Postgres.Primary.Hostname = primaryHostname
 				tracker.MarkPostgresPrimaryCertNeedsRegen()
 			}
 		}
@@ -229,9 +242,9 @@ func (c *UpdateInstallConfigCmd) applyPostgresUpdates(config *files.RootConfig,
 		}
 	}
 
-	if c.Opts.PostgresServerAddress != "" && config.Postgres.ServerAddress != c.Opts.PostgresServerAddress {
-		log.Printf("Updating PostgreSQL server address: %s -> %s\n", config.Postgres.ServerAddress, c.Opts.PostgresServerAddress)
-		config.Postgres.ServerAddress = c.Opts.PostgresServerAddress
+	if serverAddress != "" && config.Postgres.ServerAddress != serverAddress {
+		log.Printf("Updating PostgreSQL server address: %s -> %s\n", config.Postgres.ServerAddress, serverAddress)
+		config.Postgres.ServerAddress = serverAddress
 	}
 }
 
@@ -444,8 +457,7 @@ func (c *UpdateInstallConfigCmd) printSuccessMessage(tracker *SecretDependencyTr
 		}
 	}
 
-	log.Println("\nIMPORTANT: The vault file has been updated with new secrets.")
-	log.Println("   Remember to re-encrypt it with SOPS before storing.")
+	log.Println("\nThe vault file has been updated and re-encrypted with SOPS.")
 	log.Println()
 }
 

cli/cmd/update_install_config_test.go

@@ -226,7 +226,7 @@ codesphere:
 	Context("when updating PostgreSQL configuration", func() {
 		It("should update primary IP and hostname, and regenerate certificates", func() {
 			opts.PostgresPrimaryIP = "10.10.0.4"
-			opts.PostgresPrimaryHostname = "new-postgres-primary"
+			opts.PostgresServer = "new-postgres-primary"
 
 			icg := installer.NewInstallConfigManager()
 			err := cmd.UpdateInstallConfig(icg)
@@ -237,6 +237,13 @@ codesphere:
 			Expect(config.Postgres.Primary.Hostname).To(Equal("new-postgres-primary"))
 			Expect(icg.GetVault().GetSecret(files.SecretPostgresPrimaryServerKeyPem)).NotTo(BeNil())
 			Expect(config.Postgres.Primary.SSLConfig.ServerCertPem).NotTo(BeEmpty())
+
+			encrypted, err := vault.IsSOPSEncryptedFile(vaultFile.Name())
+			Expect(err).NotTo(HaveOccurred())
+			Expect(encrypted).To(BeTrue())
+			updatedVault, err := vault.LoadVaultData(vaultFile.Name(), "")
+			Expect(err).NotTo(HaveOccurred())
+			Expect(updatedVault.GetSecret(files.SecretPostgresPrimaryServerKeyPem)).NotTo(BeNil())
 		})
 
 		It("should update replica IP and name, and regenerate certificates", func() {
@@ -393,10 +400,7 @@ codesphere:
 			err = cmd.UpdateInstallConfig(icg)
 			Expect(err).NotTo(HaveOccurred())
 
-			updatedVaultContent, err := os.ReadFile(vaultFile.Name())
-			Expect(err).NotTo(HaveOccurred())
-			updatedVault := &files.InstallVault{}
-			err = updatedVault.Unmarshal(updatedVaultContent)
+			updatedVault, err := vault.LoadVaultData(vaultFile.Name(), "")
 			Expect(err).NotTo(HaveOccurred())
 
 			// Verify all initial secrets are still present with the same values
@@ -427,10 +431,7 @@ codesphere:
 			err = cmd.UpdateInstallConfig(icg)
 			Expect(err).NotTo(HaveOccurred())
 
-			updatedVaultContent, err := os.ReadFile(vaultFile.Name())
-			Expect(err).NotTo(HaveOccurred())
-			updatedVault := &files.InstallVault{}
-			err = updatedVault.Unmarshal(updatedVaultContent)
+			updatedVault, err := vault.LoadVaultData(vaultFile.Name(), "")
 			Expect(err).NotTo(HaveOccurred())
 
 			// Verify all initial secrets are still present with the same values

docs/oms_init_install-config.md

@@ -77,7 +77,7 @@ $ oms init install-config --validate -c config.yaml --vault prod.vault.yaml
       --openbao-user string           Username for OpenBao authentication (default "admin")
       --postgres-mode string          PostgreSQL setup mode (install/external)
       --postgres-primary-ip string    Primary PostgreSQL server IP
-      --postgres-server string        PostgreSQL server hostname for install mode or address for external mode
+      --postgres-server string        PostgreSQL server: primary hostname in install mode, connection address in external mode
       --profile string                Use a predefined configuration profile (dev, production, minimal)
       --registry-server string        Server for container registry
       --secrets-dir string            Secrets base directory (default "/root/secrets")

docs/oms_update_install-config.md

@@ -24,6 +24,12 @@ oms update install-config [flags]
 # Update PostgreSQL primary IP and regenerate certificates
 $ oms update install-config --postgres-primary-ip 10.10.0.4 --config config.yaml --vault prod.vault.yaml
 
+# Set the primary PostgreSQL hostname when mode is install
+$ oms update install-config --postgres-server postgres-1 --config config.yaml --vault prod.vault.yaml
+
+# Set the PostgreSQL connection address when mode is external
+$ oms update install-config --postgres-server db.example.com:5432 --config config.yaml --vault prod.vault.yaml
+
 # Update Codesphere domain
 $ oms update install-config --domain new.example.com --config config.yaml --vault prod.vault.yaml
 
@@ -55,11 +61,10 @@ $ oms update install-config --k8s-api-server 10.0.0.10 --config config.yaml --va
       --k8s-api-server string                        Kubernetes API server host
       --k8s-pod-cidr string                          Kubernetes Pod CIDR
       --k8s-service-cidr string                      Kubernetes Service CIDR
-      --postgres-primary-hostname string             Primary PostgreSQL server hostname
       --postgres-primary-ip string                   Primary PostgreSQL server IP
       --postgres-replica-ip string                   Replica PostgreSQL server IP
       --postgres-replica-name string                 Replica PostgreSQL server name
-      --postgres-server-address string               PostgreSQL server address (for external mode)
+      --postgres-server string                       PostgreSQL server: primary hostname in install mode, connection address in external mode
       --public-ip string                             Codesphere public IP address
       --vault string                                 Path to existing prod.vault.yaml file (default "prod.vault.yaml")
       --with-comments                                Add helpful comments to the generated YAML files

internal/bootstrap/gcp/gcp_test.go

@@ -235,7 +235,7 @@ var _ = Describe("GCP Bootstrapper", func() {
 			icg.EXPECT().WriteInstallConfig("fake-config-file", true).Return(nil)
 			nodeClient.EXPECT().CopyFile(mock.Anything, "fake-config-file", "/etc/codesphere/config.yaml").Return(nil)
 			nodeClient.EXPECT().CopyFile(mock.Anything, "fake-secret", "/etc/codesphere/secrets/prod.vault.yaml").Return(nil)
-			icg.EXPECT().WriteVault("fake-secret", true).Return(nil)
+			icg.EXPECT().WriteUnencryptedVault("fake-secret", true).Return(nil)
 
 			// Enable Root Login
 			nodeClient.EXPECT().WaitReady(mock.Anything, mock.Anything).Return(nil).Return(nil)

internal/bootstrap/gcp/install_config.go

@@ -414,7 +414,7 @@ func (b *GCPBootstrapper) UpdateInstallConfig() error {
 		return fmt.Errorf("failed to write config file: %w", err)
 	}
 
-	if err := b.icg.WriteVault(b.Env.SecretsFilePath, true); err != nil {
+	if err := b.icg.WriteUnencryptedVault(b.Env.SecretsFilePath, true); err != nil {
 		return fmt.Errorf("failed to write vault file: %w", err)
 	}