Initial openbao
This commit is contained in:
parent
b8e56eab20
commit
129d0d5b02
3 changed files with 416 additions and 0 deletions
406
k8s/operators/openbao/bundle.yaml
Normal file
406
k8s/operators/openbao/bundle.yaml
Normal file
|
|
@ -0,0 +1,406 @@
|
||||||
|
# DO NOT EDIT: This file has been automatically generated by the script in helm/render-all.sh, edits may get overwritten
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
name: openbao
|
||||||
|
namespace: openbao
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
name: openbao-discovery-role
|
||||||
|
namespace: openbao
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- watch
|
||||||
|
- list
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
name: openbao-discovery-rolebinding
|
||||||
|
namespace: openbao
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: openbao-discovery-role
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: openbao
|
||||||
|
namespace: openbao
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
name: openbao-server-binding
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: system:auth-delegator
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: openbao
|
||||||
|
namespace: openbao
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
extraconfig-from-values.hcl: |2-
|
||||||
|
|
||||||
|
disable_mlock = true
|
||||||
|
ui = true
|
||||||
|
|
||||||
|
listener "tcp" {
|
||||||
|
tls_disable = 1
|
||||||
|
address = "[::]:8200"
|
||||||
|
cluster_address = "[::]:8201"
|
||||||
|
# Enable unauthenticated metrics access (necessary for Prometheus Operator)
|
||||||
|
#telemetry {
|
||||||
|
# unauthenticated_metrics_access = "true"
|
||||||
|
#}
|
||||||
|
}
|
||||||
|
|
||||||
|
storage "raft" {
|
||||||
|
path = "/openbao/data"
|
||||||
|
}
|
||||||
|
|
||||||
|
service_registration "kubernetes" {}
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
name: openbao-config
|
||||||
|
namespace: openbao
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
name: openbao
|
||||||
|
namespace: openbao
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 8200
|
||||||
|
targetPort: 8200
|
||||||
|
- name: https-internal
|
||||||
|
port: 8201
|
||||||
|
targetPort: 8201
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
component: server
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
openbao-active: "true"
|
||||||
|
name: openbao-active
|
||||||
|
namespace: openbao
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 8200
|
||||||
|
targetPort: 8200
|
||||||
|
- name: https-internal
|
||||||
|
port: 8201
|
||||||
|
targetPort: 8201
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
component: server
|
||||||
|
openbao-active: "true"
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
openbao-internal: "true"
|
||||||
|
name: openbao-internal
|
||||||
|
namespace: openbao
|
||||||
|
spec:
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 8200
|
||||||
|
targetPort: 8200
|
||||||
|
- name: https-internal
|
||||||
|
port: 8201
|
||||||
|
targetPort: 8201
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
component: server
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
name: openbao-standby
|
||||||
|
namespace: openbao
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 8200
|
||||||
|
targetPort: 8200
|
||||||
|
- name: https-internal
|
||||||
|
port: 8201
|
||||||
|
targetPort: 8201
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
component: server
|
||||||
|
openbao-active: "false"
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
name: openbao
|
||||||
|
namespace: openbao
|
||||||
|
spec:
|
||||||
|
podManagementPolicy: Parallel
|
||||||
|
replicas: 3
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
component: server
|
||||||
|
serviceName: openbao-internal
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations: null
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
component: server
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
spec:
|
||||||
|
affinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
component: server
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- "cp /openbao/config/extraconfig-from-values.hcl /tmp/storageconfig.hcl;\n[
|
||||||
|
-n \"${HOST_IP}\" ] && sed -Ei \"s|HOST_IP|${HOST_IP?}|g\" /tmp/storageconfig.hcl;\n[
|
||||||
|
-n \"${POD_IP}\" ] && sed -Ei \"s|POD_IP|${POD_IP?}|g\" /tmp/storageconfig.hcl;\n[
|
||||||
|
-n \"${HOSTNAME}\" ] && sed -Ei \"s|HOSTNAME|${HOSTNAME?}|g\" /tmp/storageconfig.hcl;\n[
|
||||||
|
-n \"${API_ADDR}\" ] && sed -Ei \"s|API_ADDR|${API_ADDR?}|g\" /tmp/storageconfig.hcl;\n[
|
||||||
|
-n \"${TRANSIT_ADDR}\" ] && sed -Ei \"s|TRANSIT_ADDR|${TRANSIT_ADDR?}|g\"
|
||||||
|
/tmp/storageconfig.hcl;\n[ -n \"${RAFT_ADDR}\" ] && sed -Ei \"s|RAFT_ADDR|${RAFT_ADDR?}|g\"
|
||||||
|
/tmp/storageconfig.hcl;\n/usr/local/bin/docker-entrypoint.sh bao server
|
||||||
|
-config=/tmp/storageconfig.hcl \n"
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -ec
|
||||||
|
env:
|
||||||
|
- name: HOST_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: POD_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.podIP
|
||||||
|
- name: BAO_K8S_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: BAO_K8S_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: BAO_ADDR
|
||||||
|
value: http://127.0.0.1:8200
|
||||||
|
- name: BAO_API_ADDR
|
||||||
|
value: http://$(POD_IP):8200
|
||||||
|
- name: SKIP_CHOWN
|
||||||
|
value: "true"
|
||||||
|
- name: SKIP_SETCAP
|
||||||
|
value: "true"
|
||||||
|
- name: HOSTNAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: BAO_CLUSTER_ADDR
|
||||||
|
value: https://$(HOSTNAME).openbao-internal:8201
|
||||||
|
- name: HOME
|
||||||
|
value: /home/openbao
|
||||||
|
image: quay.io/openbao/openbao:2.0.0-alpha20240329
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
lifecycle:
|
||||||
|
preStop:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- sleep 5 && kill -SIGTERM $(pidof bao)
|
||||||
|
name: openbao
|
||||||
|
ports:
|
||||||
|
- containerPort: 8200
|
||||||
|
name: http
|
||||||
|
- containerPort: 8201
|
||||||
|
name: https-internal
|
||||||
|
- containerPort: 8202
|
||||||
|
name: http-rep
|
||||||
|
readinessProbe:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -ec
|
||||||
|
- bao status -tls-skip-verify
|
||||||
|
failureThreshold: 2
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 3
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /openbao/data
|
||||||
|
name: data
|
||||||
|
- mountPath: /openbao/config
|
||||||
|
name: config
|
||||||
|
- mountPath: /home/openbao
|
||||||
|
name: home
|
||||||
|
hostNetwork: false
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 100
|
||||||
|
serviceAccountName: openbao
|
||||||
|
terminationGracePeriodSeconds: 10
|
||||||
|
volumes:
|
||||||
|
- configMap:
|
||||||
|
name: openbao-config
|
||||||
|
name: config
|
||||||
|
- emptyDir: {}
|
||||||
|
name: home
|
||||||
|
updateStrategy:
|
||||||
|
type: OnDelete
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
name: data
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 10Gi
|
||||||
|
---
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
helm.sh/chart: openbao-0.4.0
|
||||||
|
name: openbao
|
||||||
|
namespace: openbao
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: openbao
|
||||||
|
app.kubernetes.io/name: openbao
|
||||||
|
component: server
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
helm.sh/hook: test
|
||||||
|
name: openbao-server-test
|
||||||
|
namespace: openbao
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
echo "Checking for sealed info in 'bao status' output"
|
||||||
|
ATTEMPTS=10
|
||||||
|
n=0
|
||||||
|
until [ "$n" -ge $ATTEMPTS ]
|
||||||
|
do
|
||||||
|
echo "Attempt" $n...
|
||||||
|
bao status -format yaml | grep -E '^sealed: (true|false)' && break
|
||||||
|
n=$((n+1))
|
||||||
|
sleep 5
|
||||||
|
done
|
||||||
|
if [ $n -ge $ATTEMPTS ]; then
|
||||||
|
echo "timed out looking for sealed info in 'bao status' output"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
exit 0
|
||||||
|
env:
|
||||||
|
- name: VAULT_ADDR
|
||||||
|
value: http://openbao.openbao.svc:8200
|
||||||
|
image: quay.io/openbao/openbao:2.0.0-alpha20240329
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: openbao-server-test
|
||||||
|
volumeMounts: null
|
||||||
|
restartPolicy: Never
|
||||||
|
volumes: null
|
||||||
6
k8s/operators/openbao/kustomization.yaml
Normal file
6
k8s/operators/openbao/kustomization.yaml
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
namespace: openbao
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- bundle.yaml
|
||||||
4
k8s/operators/openbao/namespace.yaml
Normal file
4
k8s/operators/openbao/namespace.yaml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: openbao
|
||||||
Loading…
Reference in a new issue