SmokyZoneandCopilot
5ef5aaa0d8
Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting secret into the OpenBao pod, and switches the listener config from tls_disable=1 to a TLS-enabled listener. UI/API is now served over https://<node-ip>:30200 instead of plain HTTP. Also updates ClusterSecretStore/bootstrap Job to use https + trust the self-signed cert via caProvider/BAO_SKIP_VERIFY. Co-authored-by: Copilot <[email protected]>
111 lines
3.5 KiB
YAML
111 lines
3.5 KiB
YAML
## Values for openbao-gitops.
|
|
##
|
|
## `openbao:` maps directly onto the upstream openbao-helm chart values
|
|
## (https://github.com/openbao/openbao-helm). Only the settings relevant for
|
|
## a standalone/file-storage deployment with ESO integration are overridden
|
|
## here - see `helm show values openbao/openbao` for the full list.
|
|
|
|
openbao:
|
|
server:
|
|
# Standalone mode: single replica, file storage backend, PVC-backed.
|
|
standalone:
|
|
enabled: true
|
|
# TLS terminated directly by OpenBao itself, using the cert-manager
|
|
# issued self-signed certificate mounted below (see templates/tls.yaml
|
|
# and the `tls:` section further down). "-tls-skip-verify" is already
|
|
# baked into the chart's readiness/liveness probes, so this doesn't
|
|
# need any extra values there.
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 0
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
tls_cert_file = "/openbao/userconfig/openbao-tls/tls.crt"
|
|
tls_key_file = "/openbao/userconfig/openbao-tls/tls.key"
|
|
}
|
|
storage "file" {
|
|
path = "/openbao/data"
|
|
}
|
|
|
|
dataStorage:
|
|
enabled: true
|
|
size: 10Gi
|
|
# Empty = cluster default StorageClass.
|
|
storageClass: ""
|
|
|
|
# Required so OpenBao's ServiceAccount can call the Kubernetes
|
|
# TokenReview API - needed for the "kubernetes" auth method used by ESO.
|
|
serviceAccount:
|
|
create: true
|
|
authDelegator:
|
|
enabled: true
|
|
|
|
# Mounts the cert-manager issued TLS secret at
|
|
# /openbao/userconfig/openbao-tls/{tls.crt,tls.key,ca.crt}.
|
|
extraVolumes:
|
|
- type: secret
|
|
name: openbao-tls
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
ui:
|
|
enabled: true
|
|
# NodePort, same pattern as ArgoCD (30080/30443) and Gitea (30300):
|
|
# reachable at https://<node-ip>:30200 without needing an Ingress.
|
|
serviceType: NodePort
|
|
serviceNodePort: 30200
|
|
|
|
injector:
|
|
# Sidecar-injector webhook is not needed for ESO integration.
|
|
enabled: false
|
|
|
|
# --- TLS (self-signed via cert-manager) -------------------------------------
|
|
|
|
tls:
|
|
enabled: true
|
|
secretName: openbao-tls
|
|
# cert-manager Certificate validity/renewal.
|
|
duration: 2160h # 90d
|
|
renewBefore: 360h # 15d
|
|
# Extra SANs beyond the in-cluster service names (which are always
|
|
# included). Add your node IP(s)/hostname(s) here so browsers hitting the
|
|
# NodePort get a matching cert.
|
|
ipAddresses:
|
|
- 192.168.2.218
|
|
dnsNames: []
|
|
|
|
# --- ESO <-> OpenBao binding -------------------------------------------------
|
|
|
|
eso:
|
|
# Namespace and ServiceAccount name that the External Secrets Operator
|
|
# (its `SecretStore`/`ClusterSecretStore`) authenticates with. Must match
|
|
# the ESO Helm release deployed via apps-in-apps.
|
|
serviceAccountName: external-secrets
|
|
namespace: external-secrets
|
|
|
|
# Name of the Vault/OpenBao Kubernetes auth role that ESO will use.
|
|
roleName: eso-role
|
|
|
|
# KV v2 mount path that ClusterSecretStore(s) will read from.
|
|
kvMountPath: secret
|
|
|
|
# One-time bootstrap Job that enables the Kubernetes auth method, creates the
|
|
# "eso-read" policy and the "eso-role" role bound to the ESO ServiceAccount.
|
|
#
|
|
# OpenBao must already be initialized AND unsealed before this can run (see
|
|
# README). Enable this only after that manual step, providing the root token
|
|
# via the referenced secret.
|
|
bootstrap:
|
|
enabled: false
|
|
image: openbao/openbao:2.6.2
|
|
rootTokenSecretName: openbao-root-token
|
|
rootTokenSecretKey: token
|