coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tolerate declarative OpenBao audit setup

Browse Source
This commit is contained in:
Bernd Worsch
2026-05-25 15:14:41 +02:00
parent 3741294b05
commit b76e9101d8
2 changed files with 70 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docs/openbao.md
View File

@@ -187,9 +187,9 @@ configuration:
make openbao-configure-initial
```
The target prompts for a token, enables file audit, enables the `platform/` KV
v2 mount, enables Kubernetes auth, configures Kubernetes auth from the in-pod
service account, and loads:
The target prompts for a token, enables file audit when API-managed audit is
available, enables the `platform/` KV v2 mount, enables Kubernetes auth,
configures Kubernetes auth from the in-pod service account, and loads:
- `openbao/policies/platform-admin.hcl`
- `openbao/policies/platform-readonly.hcl`
@@ -198,6 +198,12 @@ It does not print or store the token. You may also set
`OPENBAO_TOKEN_FILE=/path/to/token-file` for an operator-local, uncommitted
token file.
Current OpenBao releases may reject API-managed audit setup with a message that
audit devices must be configured declaratively. In that case the helper exits
successfully with a warning after applying the other bootstrap configuration.
Treat declarative audit configuration in the OpenBao server config/Helm values
as mandatory before production secrets move in.
After the helper succeeds, create a non-root admin token:
```bash