SmokyZoneandCopilot
5ef5aaa0d8
Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting secret into the OpenBao pod, and switches the listener config from tls_disable=1 to a TLS-enabled listener. UI/API is now served over https://<node-ip>:30200 instead of plain HTTP. Also updates ClusterSecretStore/bootstrap Job to use https + trust the self-signed cert via caProvider/BAO_SKIP_VERIFY. Co-authored-by: Copilot <[email protected]>
28 lines
910 B
YAML
28 lines
910 B
YAML
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao
|
|
annotations:
|
|
# Give ESO + OpenBao time to become healthy before ArgoCD tries to sync this.
|
|
argocd.argoproj.io/sync-wave: "1"
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: "{{ if .Values.tls.enabled }}https{{ else }}http{{ end }}://{{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc:8200"
|
|
path: {{ .Values.eso.kvMountPath }}
|
|
version: v2
|
|
{{- if .Values.tls.enabled }}
|
|
caProvider:
|
|
type: Secret
|
|
name: {{ .Values.tls.secretName }}
|
|
namespace: {{ .Release.Namespace }}
|
|
key: tls.crt
|
|
{{- end }}
|
|
auth:
|
|
kubernetes:
|
|
mountPath: kubernetes
|
|
role: {{ .Values.eso.roleName }}
|
|
serviceAccountRef:
|
|
name: {{ .Values.eso.serviceAccountName }}
|
|
namespace: {{ .Values.eso.namespace }}
|