add openbao deployment

2026-09-18 19:50:46 +02:00
parent 0defdf343e
commit 1c2ba585dc
6 changed files with 189 additions and 0 deletions
@@ -0,0 +1,70 @@
+{{- if .Values.bootstrap.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: openbao-bootstrap
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": before-hook-creation
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: openbao-bootstrap
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "2"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: openbao-bootstrap
+      restartPolicy: Never
+      containers:
+        - name: bootstrap
+          image: {{ .Values.bootstrap.image }}
+          env:
+            - name: BAO_ADDR
+              value: "http://{{ .Release.Name }}-openbao:8200"
+            - name: BAO_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.bootstrap.rootTokenSecretName }}
+                  key: {{ .Values.bootstrap.rootTokenSecretKey }}
+          command:
+            - sh
+            - -ec
+            - |
+              echo "Enabling kv-v2 secrets engine at {{ .Values.eso.kvMountPath }} (if not already enabled)..."
+              bao secrets enable -path={{ .Values.eso.kvMountPath }} kv-v2 || true
+
+              echo "Enabling kubernetes auth method (if not already enabled)..."
+              bao auth enable kubernetes || true
+
+              echo "Configuring kubernetes auth method against the in-cluster API..."
+              bao write auth/kubernetes/config \
+                kubernetes_host="https://kubernetes.default.svc:443"
+
+              echo "Writing eso-read policy..."
+              cat <<EOF | bao policy write eso-read -
+              path "{{ .Values.eso.kvMountPath }}/data/*" {
+                capabilities = ["read"]
+              }
+              path "{{ .Values.eso.kvMountPath }}/metadata/*" {
+                capabilities = ["list", "read"]
+              }
+              EOF
+
+              echo "Binding role '{{ .Values.eso.roleName }}' to ServiceAccount {{ .Values.eso.namespace }}/{{ .Values.eso.serviceAccountName }}..."
+              bao write auth/kubernetes/role/{{ .Values.eso.roleName }} \
+                bound_service_account_names={{ .Values.eso.serviceAccountName }} \
+                bound_service_account_namespaces={{ .Values.eso.namespace }} \
+                policies=eso-read \
+                ttl=1h
+
+              echo "Bootstrap complete."
+{{- end }}