SmokyZoneandCopilot
e27524177c
Setting a second BAO_ADDR via extraEnvironmentVars produced two entries with the same name in the container env list. kubectl itself warns this 'may be dropped when using apply', and in practice the live StatefulSet kept only the first (http) value, leaving the pod stuck NotReady. The chart already exposes global.tlsDisable specifically to drive BAO_ADDR/health-check scheme - use that instead. Co-authored-by: Copilot <[email protected]>
116 lines
3.7 KiB
YAML
116 lines
3.7 KiB
YAML
## Values for openbao-gitops.
|
|
##
|
|
## `openbao:` maps directly onto the upstream openbao-helm chart values
|
|
## (https://github.com/openbao/openbao-helm). Only the settings relevant for
|
|
## a standalone/file-storage deployment with ESO integration are overridden
|
|
## here - see `helm show values openbao/openbao` for the full list.
|
|
|
|
openbao:
|
|
# Tells the chart's own helpers (BAO_ADDR, health-check scheme, etc.) that
|
|
# the server listener speaks TLS - avoids duplicate/conflicting env vars.
|
|
global:
|
|
tlsDisable: false
|
|
|
|
server:
|
|
# Standalone mode: single replica, file storage backend, PVC-backed.
|
|
standalone:
|
|
enabled: true
|
|
# TLS terminated directly by OpenBao itself, using the cert-manager
|
|
# issued self-signed certificate mounted below (see templates/tls.yaml
|
|
# and the `tls:` section further down). "-tls-skip-verify" is already
|
|
# baked into the chart's readiness/liveness probes, so this doesn't
|
|
# need any extra values there.
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 0
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
tls_cert_file = "/openbao/userconfig/openbao-tls/tls.crt"
|
|
tls_key_file = "/openbao/userconfig/openbao-tls/tls.key"
|
|
}
|
|
storage "file" {
|
|
path = "/openbao/data"
|
|
}
|
|
|
|
dataStorage:
|
|
enabled: true
|
|
size: 10Gi
|
|
# Empty = cluster default StorageClass.
|
|
storageClass: ""
|
|
|
|
# Required so OpenBao's ServiceAccount can call the Kubernetes
|
|
# TokenReview API - needed for the "kubernetes" auth method used by ESO.
|
|
serviceAccount:
|
|
create: true
|
|
authDelegator:
|
|
enabled: true
|
|
|
|
# Mounts the cert-manager issued TLS secret at
|
|
# /openbao/userconfig/openbao-tls/{tls.crt,tls.key,ca.crt}.
|
|
extraVolumes:
|
|
- type: secret
|
|
name: openbao-tls
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
ui:
|
|
enabled: true
|
|
# NodePort, same pattern as ArgoCD (30080/30443) and Gitea (30300):
|
|
# reachable at https://<node-ip>:30200 without needing an Ingress.
|
|
serviceType: NodePort
|
|
serviceNodePort: 30200
|
|
|
|
injector:
|
|
# Sidecar-injector webhook is not needed for ESO integration.
|
|
enabled: false
|
|
|
|
# --- TLS (self-signed via cert-manager) -------------------------------------
|
|
|
|
tls:
|
|
enabled: true
|
|
secretName: openbao-tls
|
|
# cert-manager Certificate validity/renewal.
|
|
duration: 2160h # 90d
|
|
renewBefore: 360h # 15d
|
|
# Extra SANs beyond the in-cluster service names (which are always
|
|
# included). Add your node IP(s)/hostname(s) here so browsers hitting the
|
|
# NodePort get a matching cert.
|
|
ipAddresses:
|
|
- 192.168.2.218
|
|
dnsNames: []
|
|
|
|
# --- ESO <-> OpenBao binding -------------------------------------------------
|
|
|
|
eso:
|
|
# Namespace and ServiceAccount name that the External Secrets Operator
|
|
# (its `SecretStore`/`ClusterSecretStore`) authenticates with. Must match
|
|
# the ESO Helm release deployed via apps-in-apps.
|
|
serviceAccountName: external-secrets
|
|
namespace: external-secrets
|
|
|
|
# Name of the Vault/OpenBao Kubernetes auth role that ESO will use.
|
|
roleName: eso-role
|
|
|
|
# KV v2 mount path that ClusterSecretStore(s) will read from.
|
|
kvMountPath: secret
|
|
|
|
# One-time bootstrap Job that enables the Kubernetes auth method, creates the
|
|
# "eso-read" policy and the "eso-role" role bound to the ESO ServiceAccount.
|
|
#
|
|
# OpenBao must already be initialized AND unsealed before this can run (see
|
|
# README). Enable this only after that manual step, providing the root token
|
|
# via the referenced secret.
|
|
bootstrap:
|
|
enabled: false
|
|
image: openbao/openbao:2.6.2
|
|
rootTokenSecretName: openbao-root-token
|
|
rootTokenSecretKey: token
|