Add Master OpenBao Instance#56
Conversation
| make master-openbao-setup | ||
| ``` | ||
|
|
||
| **By default, Master OpenBao is not installed as part of `vshnpostgresql` nor `vshnall`.** |
There was a problem hiding this comment.
Idea: let's introduce a vshnopenbao and add it to vshnall.
There was a problem hiding this comment.
sounds good to me, I renamed master-openbao to vshnopenbao. The service name convention matches other services now.
| bao status | ||
|
|
||
| # Generate token required for auto-unseal of another OpenBao instance | ||
| bao token create -orphan -policy="autounseal" -period=24h -format=json > auto-unseal.json |
There was a problem hiding this comment.
Haven't done bao in a while, but this will create a periodic token, that will keep itself from expiring if it's used within the specified period, right?
I'd bump that up to 100h or something for the dev instance, otherwise we'd have to re-generate tokens again after a weekend.
There was a problem hiding this comment.
We can make it indefinite with
bao token create -orphan -policy="autounseal" -no-default-policy -format=json > auto-unseal.json
so it never expires. I just added updated command to README.md
| command: | ||
| - "/bin/sh" | ||
| - "-cex" | ||
| - "chown -R 100:1000 /openbao/data" |
There was a problem hiding this comment.
Just to be sure 100:1000 is not a typo?
There was a problem hiding this comment.
should be correct, I think those are default values for UID and GID in OpenBao Helm Chart.
| vcluster-clean: ## If you break Crossplane hard enough just remove the whole vcluster | ||
| $(vcluster_bin) rm controlplane || true | ||
|
|
||
| master-openbao-setup: $(master_openbao_sentinel) ## Install local forgejo instance to host argocd repos |
There was a problem hiding this comment.
Maybe a target to renew the unseal token manually would be nice.
There was a problem hiding this comment.
I'd keep it in README.md for now. Let's see how often it is used and maybe then we can add it as a target?
2 participants
The OpenBao service supports an autounseal configuration. To enable proper end-to-end testing of this feature, a new target has been added to kindev: the Master OpenBao Instance.
What's included: