Vault — алерт когда mount/secret-engine исчез

#!/usr/bin/env bash
# /etc/cron.d/vault-mount
# */15 * * * * root /opt/vault-mount.sh

export VAULT_ADDR=${VAULT_ADDR}
export VAULT_TOKEN=${VAULT_TOKEN}

# Comma-separated list of expected mount paths
EXPECTED=${EXPECTED:-database/,kv/,pki/}

LIVE=$(vault secrets list -format=json | jq -r 'keys[]')

MISSING=""
IFS=',' read -ra MOUNTS <<< "$EXPECTED"
for M in "${MOUNTS[@]}"; do
  if ! echo "$LIVE" | grep -qx "$M"; then
    MISSING="$MISSING$M,"
  fi
done

if [ -n "$MISSING" ]; then
  curl -fsS "$HEARTBEAT_URL" --data-urlencode "missing_mounts=$MISSING"
  exit 2
fi
echo "OK (all expected mounts present)"