tegwick
6ddf4e56b4
Streamline bao.coulomb.social login as "Sign in with KeyCape" via a versioned nginx gateway that injects overlay assets and proxies to OpenBao. Disable chart ingress in favor of the overlay ingress, wire make openbao-deploy, and add openbao-verify-login-overlay with upstream drift detection.
135 lines
2.7 KiB
YAML
135 lines
2.7 KiB
YAML
# Railiance S3 OpenBao platform secrets service.
|
|
#
|
|
# This file intentionally contains no secret material. OpenBao initialization
|
|
# creates unseal keys and the initial root token; handle those outside Git
|
|
# during the bootstrap ceremony documented in docs/openbao.md.
|
|
|
|
global:
|
|
namespace: openbao
|
|
tlsDisable: true
|
|
|
|
injector:
|
|
enabled: false
|
|
|
|
server:
|
|
enabled: true
|
|
logLevel: info
|
|
logFormat: json
|
|
|
|
image:
|
|
registry: quay.io
|
|
repository: openbao/openbao
|
|
tag: "2.5.4"
|
|
pullPolicy: IfNotPresent
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
# Public browser ingress is owned by helm/openbao-ui-overlay-k8s.yaml so the
|
|
# KeyCape login overlay gateway can inject overlay assets.
|
|
ingress:
|
|
enabled: false
|
|
|
|
authDelegator:
|
|
enabled: true
|
|
|
|
# Single-node Railiance01 bootstrap. Remove this override and scale
|
|
# server.ha.replicas when Railiance02/03 join with distributed storage.
|
|
affinity: ""
|
|
|
|
readinessProbe:
|
|
enabled: true
|
|
path: /v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204
|
|
port: 8200
|
|
|
|
livenessProbe:
|
|
enabled: true
|
|
path: /v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204
|
|
port: 8200
|
|
initialDelaySeconds: 60
|
|
|
|
networkPolicy:
|
|
enabled: true
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector: {}
|
|
ports:
|
|
- port: 8200
|
|
protocol: TCP
|
|
- port: 8201
|
|
protocol: TCP
|
|
|
|
dataStorage:
|
|
enabled: true
|
|
size: 5Gi
|
|
storageClass: local-path
|
|
accessMode: ReadWriteOnce
|
|
|
|
auditStorage:
|
|
enabled: true
|
|
size: 2Gi
|
|
storageClass: local-path
|
|
accessMode: ReadWriteOnce
|
|
|
|
standalone:
|
|
enabled: false
|
|
|
|
ha:
|
|
enabled: true
|
|
replicas: 1
|
|
disruptionBudget:
|
|
enabled: false
|
|
raft:
|
|
enabled: true
|
|
setNodeId: true
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
|
|
telemetry {
|
|
unauthenticated_metrics_access = "true"
|
|
}
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/openbao/data"
|
|
}
|
|
|
|
audit "file" "file" {
|
|
description = "Default file audit device on the OpenBao audit PVC."
|
|
|
|
options {
|
|
file_path = "/openbao/audit/openbao-audit.log"
|
|
}
|
|
}
|
|
|
|
service_registration "kubernetes" {}
|
|
|
|
telemetry {
|
|
prometheus_retention_time = "30s"
|
|
disable_hostname = true
|
|
}
|
|
|
|
serviceAccount:
|
|
create: true
|
|
name: openbao
|
|
serviceDiscovery:
|
|
enabled: true
|
|
|
|
ui:
|
|
enabled: true
|
|
serviceType: ClusterIP
|
|
activeOpenbaoPodOnly: false
|
|
|
|
csi:
|
|
enabled: false
|