SmokyZoneandCopilot
ffaf7247fe
Matches the existing cluster convention (ArgoCD 30080/30443, Gitea 30300): no Ingress needed, reachable directly at <node-ip>:30200. Co-authored-by: Copilot <[email protected]>
72 lines
2.2 KiB
YAML
72 lines
2.2 KiB
YAML
## Values for openbao-gitops.
|
|
##
|
|
## `openbao:` maps directly onto the upstream openbao-helm chart values
|
|
## (https://github.com/openbao/openbao-helm). Only the settings relevant for
|
|
## a standalone/file-storage deployment with ESO integration are overridden
|
|
## here - see `helm show values openbao/openbao` for the full list.
|
|
|
|
openbao:
|
|
server:
|
|
# Standalone mode: single replica, file storage backend, PVC-backed.
|
|
standalone:
|
|
enabled: true
|
|
|
|
dataStorage:
|
|
enabled: true
|
|
size: 10Gi
|
|
# Empty = cluster default StorageClass.
|
|
storageClass: ""
|
|
|
|
# Required so OpenBao's ServiceAccount can call the Kubernetes
|
|
# TokenReview API - needed for the "kubernetes" auth method used by ESO.
|
|
serviceAccount:
|
|
create: true
|
|
authDelegator:
|
|
enabled: true
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
ui:
|
|
enabled: true
|
|
# NodePort, same pattern as ArgoCD (30080/30443) and Gitea (30300):
|
|
# reachable at http://<node-ip>:30200 without needing an Ingress.
|
|
serviceType: NodePort
|
|
serviceNodePort: 30200
|
|
|
|
injector:
|
|
# Sidecar-injector webhook is not needed for ESO integration.
|
|
enabled: false
|
|
|
|
# --- ESO <-> OpenBao binding -------------------------------------------------
|
|
|
|
eso:
|
|
# Namespace and ServiceAccount name that the External Secrets Operator
|
|
# (its `SecretStore`/`ClusterSecretStore`) authenticates with. Must match
|
|
# the ESO Helm release deployed via apps-in-apps.
|
|
serviceAccountName: external-secrets
|
|
namespace: external-secrets
|
|
|
|
# Name of the Vault/OpenBao Kubernetes auth role that ESO will use.
|
|
roleName: eso-role
|
|
|
|
# KV v2 mount path that ClusterSecretStore(s) will read from.
|
|
kvMountPath: secret
|
|
|
|
# One-time bootstrap Job that enables the Kubernetes auth method, creates the
|
|
# "eso-read" policy and the "eso-role" role bound to the ESO ServiceAccount.
|
|
#
|
|
# OpenBao must already be initialized AND unsealed before this can run (see
|
|
# README). Enable this only after that manual step, providing the root token
|
|
# via the referenced secret.
|
|
bootstrap:
|
|
enabled: false
|
|
image: openbao/openbao:2.6.2
|
|
rootTokenSecretName: openbao-root-token
|
|
rootTokenSecretKey: token
|