add openbao deployment

2026-09-18 19:50:46 +02:00
parent 0defdf343e
commit 1c2ba585dc
6 changed files with 189 additions and 0 deletions
@@ -0,0 +1,68 @@
+## Values for openbao-gitops.
+##
+## `openbao:` maps directly onto the upstream openbao-helm chart values
+## (https://github.com/openbao/openbao-helm). Only the settings relevant for
+## a standalone/file-storage deployment with ESO integration are overridden
+## here - see `helm show values openbao/openbao` for the full list.
+
+openbao:
+  server:
+    # Standalone mode: single replica, file storage backend, PVC-backed.
+    standalone:
+      enabled: true
+
+    dataStorage:
+      enabled: true
+      size: 10Gi
+      # Empty = cluster default StorageClass.
+      storageClass: ""
+
+    # Required so OpenBao's ServiceAccount can call the Kubernetes
+    # TokenReview API - needed for the "kubernetes" auth method used by ESO.
+    serviceAccount:
+      create: true
+      authDelegator:
+        enabled: true
+
+    resources:
+      requests:
+        cpu: 250m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi
+
+  ui:
+    enabled: true
+    serviceType: ClusterIP
+
+  injector:
+    # Sidecar-injector webhook is not needed for ESO integration.
+    enabled: false
+
+# --- ESO <-> OpenBao binding -------------------------------------------------
+
+eso:
+  # Namespace and ServiceAccount name that the External Secrets Operator
+  # (its `SecretStore`/`ClusterSecretStore`) authenticates with. Must match
+  # the ESO Helm release deployed via apps-in-apps.
+  serviceAccountName: external-secrets
+  namespace: external-secrets
+
+  # Name of the Vault/OpenBao Kubernetes auth role that ESO will use.
+  roleName: eso-role
+
+  # KV v2 mount path that ClusterSecretStore(s) will read from.
+  kvMountPath: secret
+
+# One-time bootstrap Job that enables the Kubernetes auth method, creates the
+# "eso-read" policy and the "eso-role" role bound to the ESO ServiceAccount.
+#
+# OpenBao must already be initialized AND unsealed before this can run (see
+# README). Enable this only after that manual step, providing the root token
+# via the referenced secret.
+bootstrap:
+  enabled: false
+  image: openbao/openbao:2.6.2
+  rootTokenSecretName: openbao-root-token
+  rootTokenSecretKey: token