feat: add openbao

2026-04-15 19:46:16 -05:00
parent 5bfd7ce82d
commit 9bd7556071
13 changed files with 519 additions and 0 deletions
@@ -0,0 +1,166 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: openbao-snapshot-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: openbao-snapshot-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: AWS_ACCESS_KEY_ID
+      remoteRef:
+        key: /garage/home-infra/openbao-backups
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        key: /garage/home-infra/openbao-backups
+        property: ACCESS_REGION
+    - secretKey: AWS_SECRET_ACCESS_KEY
+      remoteRef:
+        key: /garage/home-infra/openbao-backups
+        property: ACCESS_SECRET_KEY
+    - secretKey: BUCKET
+      remoteRef:
+        key: /garage/home-infra/openbao-backups
+        property: BUCKET
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: openbao-unseal-config-1
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: openbao-unseal-config-1
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ENVIRONMENT
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: ENVIRONMENT
+    - secretKey: NODES
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: NODES
+    - secretKey: TOKENS
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: TOKENS_1
+    - secretKey: NOTIFY_QUEUE_URLS
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: NOTIFY_QUEUE_URLS
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: openbao-unseal-config-2
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: openbao-unseal-config-2
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ENVIRONMENT
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: ENVIRONMENT
+    - secretKey: NODES
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: NODES
+    - secretKey: TOKENS
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: TOKENS_2
+    - secretKey: NOTIFY_QUEUE_URLS
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: NOTIFY_QUEUE_URLS
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: openbao-unseal-config-3
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: openbao-unseal-config-3
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ENVIRONMENT
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: ENVIRONMENT
+    - secretKey: NODES
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: NODES
+    - secretKey: TOKENS
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: TOKENS_3
+    - secretKey: NOTIFY_QUEUE_URLS
+      remoteRef:
+        key: /cl01tl/openbao/unseal
+        property: NOTIFY_QUEUE_URLS
+
+# ---
+# apiVersion: external-secrets.io/v1
+# kind: ExternalSecret
+# metadata:
+#   name: openbao-token
+#   namespace: {{ .Release.Namespace }}
+#   labels:
+#     app.kubernetes.io/name: openbao-token
+#     app.kubernetes.io/instance: {{ .Release.Name }}
+#     app.kubernetes.io/part-of: {{ .Release.Name }}
+# spec:
+#   secretStoreRef:
+#     kind: ClusterSecretStore
+#     name: openbao
+#   data:
+#     - secretKey: token
+#       remoteRef:
+#         key: /cl01tl/openbao/token
+#         property: token
+#     - secretKey: unseal_key_1
+#       remoteRef:
+#         key: /cl01tl/openbao/token
+#         property: unseal_key_1
+#     - secretKey: unseal_key_2
+#       remoteRef:
+#         key: /cl01tl/openbao/token
+#         property: unseal_key_2
+#     - secretKey: unseal_key_3
+#       remoteRef:
+#         key: /cl01tl/openbao/token
+#         property: unseal_key_3
+#     - secretKey: unseal_key_4
+#       remoteRef:
+#         key: /cl01tl/openbao/token
+#         property: unseal_key_4
+#     - secretKey: unseal_key_5
+#       remoteRef:
+#         key: /cl01tl/openbao/token
+#         property: unseal_key_5
@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: openbao-tailscale
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: openbao-tailscale
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    tailscale.com/proxy-class: no-metrics
+  annotations:
+    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
+spec:
+  ingressClassName: tailscale
+  tls:
+    - hosts:
+        - openbao-cl01tl
+      secretName: openbao-cl01tl
+  rules:
+    - host: openbao-cl01tl
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: openbao-active
+                port:
+                  number: 8200