nordisk/Skidbladnir

openbao — guide

Class: guide · audience: a techie wiring an env to OpenBao. The what is in openbao-design.md; step-by-step in openbao-for-idiots.md.

Enable the feature

skidbladnir = { path = "…", features = ["openbao"] }

Off by default — the offline core never compiles reqwest.

From code

use skidbladnir::openbao::OpenBao;

let ob = OpenBao::from_env()?;              // VAULT_ADDR/BAO_ADDR + VAULT_TOKEN/BAO_TOKEN
ob.enable_kubernetes_auth()?;               // mount auth/kubernetes (idempotent)
ob.configure_kubernetes("https://kubernetes.default.svc")?;
ob.provision_env("test1", "test1-njord", "test1")?;   // read policy + role

provision_env(env, sa, ns) writes the env's read policy (secret/data/<env>/*) and a k8s-auth role of the same name binding ServiceAccount sa in namespace ns.

From the CLI (the example)

kubectl -n openbao port-forward svc/openbao 8200:8200 &
export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=$(python3 -c "import json,os;print(json.load(open(os.path.expanduser('~/.config/openbao/init.json')))['root_token'])")

cargo run --features openbao --example openbao-provision -- \
  lab:njord-lab:njord-lab test1:test1-njord:test1 test2:test2-njord:test2

Idempotent; re-run any time. (--k8s-host URL overrides the API address.)

What this does NOT do (do these yourself)

1. Write the values — tillsynia-admin vault-write --namespace <env> --secret <env>-njord (lab uses --path secret/data/lab/app since ns njord-lab ≠ env lab).
2. system:auth-delegator CRB — kubectl apply -f deploy/openbao/rbac.yaml (login-time TokenReview needs it; RBAC grant, apply with approval).
3. Install the Agent injector — helm upgrade --install openbao-injector openbao/openbao -n openbao --set server.enabled=false --set injector.enabled=true --set injector.externalVaultAddr=http://openbao.openbao.svc:8200.
4. Turn an env on — helm upgrade <env> deploy/helm/njord -n <ns> --reuse-values --set vault.enabled=true --set vault.role=<env> --set vault.secretPath=secret/data/<env>/app.

Full turn-on runbook + prod caveat: Njord deploy/openbao/README.md §turn-on and .nornir/tillsynia-admin.md.