Vault — алерт когда secret не ротировался дольше N дней

#!/usr/bin/env bash
# /etc/cron.d/vault-rotation
# 0 6 * * * root /opt/vault-rotation.sh

export VAULT_ADDR=${VAULT_ADDR}
export VAULT_TOKEN=${VAULT_TOKEN}
PATHS=${PATHS:-database/static-creds/app1,database/static-creds/app2}
MAX_DAYS=${MAX_DAYS:-90}

NOW=$(date +%s)
STALE=""
IFS=',' read -ra LIST <<< "$PATHS"
for P in "${LIST[@]}"; do
  TS=$(vault read -format=json "$P" 2>/dev/null \
    | jq -r '.data.last_vault_rotation // ""')
  [ -z "$TS" ] && continue
  EPOCH=$(date -d "$TS" +%s 2>/dev/null || echo 0)
  DAYS=$(( (NOW - EPOCH) / 86400 ))
  if [ "$DAYS" -gt "$MAX_DAYS" ]; then
    STALE="$STALE$P=${DAYS}d,"
  fi
done

if [ -n "$STALE" ]; then
  curl -fsS "$HEARTBEAT_URL" --data-urlencode "stale_secrets=$STALE"
  exit 2
fi
echo "OK (all secrets rotated within ${MAX_DAYS}d)"