.nornir/openbao-for-idiots.md · nordisk/Skidbladnir

openbao — for idiots (turn an env on, step by step)

Class: idiot. Every step, nothing assumed. Goal: make a Njord env read its secrets from OpenBao instead of a baked-in k8s Secret. If you know Rust, read openbao-guide.md.

There are four things. Skidbladnir's openbao module does step 2; the rest are one command each. Do it on test1 first (it's disposable). Never touch prod.

0. Get a shell that can reach the cluster + vault

export KUBECONFIG=~/njord-kubeconfig-current.yaml          # or Njord/drift/lab/kubeconfig
kubectl -n openbao port-forward svc/openbao 8200:8200 &     # leave running
export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=$(python3 -c "import json,os;print(json.load(open(os.path.expanduser('~/.config/openbao/init.json')))['root_token'])")

1. Put the secret VALUES in the vault (tillsynia-admin)

tillsynia-admin vault-write --namespace test1 --secret test1-njord

Writes secret/data/test1/app from the running Secret. (Lab: add --path secret/data/lab/app.)

2. Provision the STRUCTURE (this module)

cargo run --features openbao --example openbao-provision -- test1:test1-njord:test1

Enables the k8s auth method + writes test1's read policy and role. Idempotent.

3. Let the vault trust the cluster's identity check (one-time, whole cluster)

kubectl apply -f deploy/openbao/rbac.yaml     # the system:auth-delegator CRB

4. Install the injector (one-time) + turn the env on

helm repo add openbao https://openbao.github.io/openbao-helm && helm repo update
helm upgrade --install openbao-injector openbao/openbao -n openbao \
  --set server.enabled=false --set injector.enabled=true \
  --set injector.externalVaultAddr=http://openbao.openbao.svc:8200

helm upgrade test1 deploy/helm/njord -n test1 --reuse-values \
  --set vault.enabled=true --set vault.role=test1 --set vault.secretPath=secret/data/test1/app

Did it work?

kubectl -n test1 get pod          # the app pod should have an extra vault-agent container
kubectl -n test1 logs deploy/test1-njord -c vault-agent | tail

The pod sources /vault/secrets/app.env before it boots. Broke? Instant undo: helm upgrade test1 … --set vault.enabled=false. Once test1 is proven, repeat for test2 and lab.