add openbao deployment

2026-09-18 19:50:46 +02:00
parent 0defdf343e
commit 1c2ba585dc
6 changed files with 189 additions and 0 deletions
@@ -0,0 +1,70 @@
+{{- if .Values.bootstrap.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: openbao-bootstrap
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": before-hook-creation
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: openbao-bootstrap
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "2"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: openbao-bootstrap
+      restartPolicy: Never
+      containers:
+        - name: bootstrap
+          image: {{ .Values.bootstrap.image }}
+          env:
+            - name: BAO_ADDR
+              value: "http://{{ .Release.Name }}-openbao:8200"
+            - name: BAO_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.bootstrap.rootTokenSecretName }}
+                  key: {{ .Values.bootstrap.rootTokenSecretKey }}
+          command:
+            - sh
+            - -ec
+            - |
+              echo "Enabling kv-v2 secrets engine at {{ .Values.eso.kvMountPath }} (if not already enabled)..."
+              bao secrets enable -path={{ .Values.eso.kvMountPath }} kv-v2 || true
+
+              echo "Enabling kubernetes auth method (if not already enabled)..."
+              bao auth enable kubernetes || true
+
+              echo "Configuring kubernetes auth method against the in-cluster API..."
+              bao write auth/kubernetes/config \
+                kubernetes_host="https://kubernetes.default.svc:443"
+
+              echo "Writing eso-read policy..."
+              cat <<EOF | bao policy write eso-read -
+              path "{{ .Values.eso.kvMountPath }}/data/*" {
+                capabilities = ["read"]
+              }
+              path "{{ .Values.eso.kvMountPath }}/metadata/*" {
+                capabilities = ["list", "read"]
+              }
+              EOF
+
+              echo "Binding role '{{ .Values.eso.roleName }}' to ServiceAccount {{ .Values.eso.namespace }}/{{ .Values.eso.serviceAccountName }}..."
+              bao write auth/kubernetes/role/{{ .Values.eso.roleName }} \
+                bound_service_account_names={{ .Values.eso.serviceAccountName }} \
+                bound_service_account_namespaces={{ .Values.eso.namespace }} \
+                policies=eso-read \
+                ttl=1h
+
+              echo "Bootstrap complete."
+{{- end }}
@@ -0,0 +1,20 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao
+  annotations:
+    # Give ESO + OpenBao time to become healthy before ArgoCD tries to sync this.
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  provider:
+    vault:
+      server: "http://{{ .Release.Name }}-openbao.{{ .Release.Namespace }}.svc:8200"
+      path: {{ .Values.eso.kvMountPath }}
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: {{ .Values.eso.roleName }}
+          serviceAccountRef:
+            name: {{ .Values.eso.serviceAccountName }}
+            namespace: {{ .Values.eso.namespace }}