SmokyZoneandCopilot
5ef5aaa0d8
Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting secret into the OpenBao pod, and switches the listener config from tls_disable=1 to a TLS-enabled listener. UI/API is now served over https://<node-ip>:30200 instead of plain HTTP. Also updates ClusterSecretStore/bootstrap Job to use https + trust the self-signed cert via caProvider/BAO_SKIP_VERIFY. Co-authored-by: Copilot <[email protected]>
75 lines
2.7 KiB
YAML
75 lines
2.7 KiB
YAML
{{- if .Values.bootstrap.enabled }}
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: openbao-bootstrap
|
|
namespace: {{ .Release.Namespace }}
|
|
annotations:
|
|
"helm.sh/hook": post-install,post-upgrade
|
|
"helm.sh/hook-weight": "1"
|
|
"helm.sh/hook-delete-policy": before-hook-creation
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: openbao-bootstrap
|
|
namespace: {{ .Release.Namespace }}
|
|
annotations:
|
|
"helm.sh/hook": post-install,post-upgrade
|
|
"helm.sh/hook-weight": "2"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
serviceAccountName: openbao-bootstrap
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: bootstrap
|
|
image: {{ .Values.bootstrap.image }}
|
|
env:
|
|
- name: BAO_ADDR
|
|
value: "{{ if .Values.tls.enabled }}https{{ else }}http{{ end }}://{{ include "openbao-gitops.openbaoFullname" . }}:8200"
|
|
{{- if .Values.tls.enabled }}
|
|
- name: BAO_SKIP_VERIFY
|
|
value: "true"
|
|
{{- end }}
|
|
- name: BAO_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.bootstrap.rootTokenSecretName }}
|
|
key: {{ .Values.bootstrap.rootTokenSecretKey }}
|
|
command:
|
|
- sh
|
|
- -ec
|
|
- |
|
|
echo "Enabling kv-v2 secrets engine at {{ .Values.eso.kvMountPath }} (if not already enabled)..."
|
|
bao secrets enable -path={{ .Values.eso.kvMountPath }} kv-v2 || true
|
|
|
|
echo "Enabling kubernetes auth method (if not already enabled)..."
|
|
bao auth enable kubernetes || true
|
|
|
|
echo "Configuring kubernetes auth method against the in-cluster API..."
|
|
bao write auth/kubernetes/config \
|
|
kubernetes_host="https://kubernetes.default.svc:443"
|
|
|
|
echo "Writing eso-read policy..."
|
|
cat <<EOF | bao policy write eso-read -
|
|
path "{{ .Values.eso.kvMountPath }}/data/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "{{ .Values.eso.kvMountPath }}/metadata/*" {
|
|
capabilities = ["list", "read"]
|
|
}
|
|
EOF
|
|
|
|
echo "Binding role '{{ .Values.eso.roleName }}' to ServiceAccount {{ .Values.eso.namespace }}/{{ .Values.eso.serviceAccountName }}..."
|
|
bao write auth/kubernetes/role/{{ .Values.eso.roleName }} \
|
|
bound_service_account_names={{ .Values.eso.serviceAccountName }} \
|
|
bound_service_account_namespaces={{ .Values.eso.namespace }} \
|
|
policies=eso-read \
|
|
ttl=1h
|
|
|
|
echo "Bootstrap complete."
|
|
{{- end }}
|