Openbao Module #485
Openbao Module #485
Conversation
Shrinidhi-59
requested review from
anshulsao,
ishaankalra,
pramodh-ayyappan,
rr0hit,
unni-facets and
vishnukv-facets
as code owners
WalkthroughAdds OpenBao support: new intent facet, module facet schema, Terraform module (Helm release, PVC, secrets, RBAC, init Job with init/unseal/join logic), variables/outputs, outputs schema, and README documentation. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor User
participant TF as Terraform
participant K8s as Kubernetes API
participant Helm as Helm
participant InitJob as openbao_init Job
participant Pods as OpenBao Pods
participant Secret as K8s Secret
User->>TF: apply (openbao module)
TF->>K8s: create Namespace, PVC, Secret (unseal_key), SA, Role, RoleBinding, Job (init)
TF->>Helm: install/upgrade helm_release (chart values)
Helm->>K8s: create StatefulSet/Deployments, Services
K8s-->>TF: resource readiness
rect rgb(237,247,237)
note right of InitJob: Initialization & unseal flow
InitJob->>Pods: detect leader / initialize cluster
InitJob->>Secret: write root token & recovery keys
alt HA (raft)
InitJob->>Pods: join peers to Raft cluster
end
InitJob->>Pods: unseal nodes, enable k8s auth, create policies
end
TF->>K8s: read data.kubernetes_secret_v1.openbao_init_keys
TF-->>User: outputs (service URLs, secret refs, sensitive tokens)
Suggested reviewers
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🧰 Additional context used🪛 Checkov (3.2.334)modules/openbao/default/1.0/main.tf[medium] 223-234: Ensure Terraform module sources use a commit hash (CKV_TF_1) [high] 223-234: Ensure Terraform module sources use a tag with a version number (CKV_TF_2) Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
🧹 Nitpick comments (4)
modules/openbao/default/1.0/facets.yaml (2)
5-6: Clouds limited to azure.If this module is Kubernetes-only, consider omitting clouds or listing all supported (aws, gcp, azure) to avoid artificial constraints.
123-130: Sample config alignment with README.Ensure
kind/flavor/versionhere match README examples to prevent user confusion (README uses different values).outputs/openbao/output.facets.yaml (1)
45-49: Consider structuring recovery_keys as an array.If recovery keys are multiple values, model as
type: array(strings) instead of a JSON string to improve UX. Keep listing insecretsfor sensitivity.modules/openbao/default/1.0/variables.tf (1)
19-19: Chart version default: consider surfacing validation.Optionally validate
chart_versionformat (e.g., semver) to catch typos early.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (7)
intents/openbao/facets.yaml(1 hunks)modules/openbao/default/1.0/README.md(1 hunks)modules/openbao/default/1.0/facets.yaml(1 hunks)modules/openbao/default/1.0/main.tf(1 hunks)modules/openbao/default/1.0/outputs.tf(1 hunks)modules/openbao/default/1.0/variables.tf(1 hunks)outputs/openbao/output.facets.yaml(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
modules/openbao/default/1.0/main.tf
[medium] 222-233: Ensure Terraform module sources use a commit hash
(CKV_TF_1)
[high] 222-233: Ensure Terraform module sources use a tag with a version number
(CKV_TF_2)
🪛 markdownlint-cli2 (0.18.1)
modules/openbao/default/1.0/README.md
19-19: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
109-109: Bare URL used
(MD034, no-bare-urls)
🔇 Additional comments (3)
intents/openbao/facets.yaml (1)
1-5: Looks good; facet metadata is clear and consistent.No issues spotted.
modules/openbao/default/1.0/main.tf (1)
557-559: Verify BAO service and pod naming assumptionsAssumes:
- Service
${release_name}-openbao- Headless service
${release_name}-internal- Pod names
${release_name}-0,${release_name}-1, …Confirm these match the OpenBao Helm chart or live cluster (e.g. via
helm templateorkubectl get svc,sts,pods -n <namespace>). If they differ, updateBAO_ADDRand the raft join URL accordingly.modules/openbao/default/1.0/outputs.tf (1)
5-9: Verify OpenBao service naming
The Terraform outputs assume the Kubernetes Service is named${lookup(local.spec, "release_name", "openbao")}-openbao. Confirm the deployed Helm chart actually creates a Service with that exact suffix or make the suffix configurable.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (2)
modules/openbao/default/1.0/main.tf (2)
275-279: RBAC verb mix blocks kubectl wait.The init job runs
kubectl wait, which requireswatchon pods. The current rule lackswatchand instead grantscreateon pods (not needed). Result: the job hits a forbidden error and never completes. Replace the verbs with["get", "list", "watch"]forpods, and keepcreateonly on thepods/execsubresource if required. Example:rule { api_groups = [""] - resources = ["pods", "pods/exec"] - verbs = ["get", "list", "create"] + resources = ["pods"] + verbs = ["get", "list", "watch"] + } + + rule { + api_groups = [""] + resources = ["pods/exec"] + verbs = ["create"] }This grants the minimum set the script needs and lets
kubectl waitsucceed.
354-558: Init job container lacks bash/jq; script fails immediately.Image
alpine/k8s:1.28.3doesn’t ship/bin/bashorjq. The job invokes both, so it errors before doing any initialization. Switch to/bin/shand installjq(or choose an image that already has them). For example:- image = "alpine/k8s:1.28.3" - command = ["/bin/bash", "-c"] + image = "alpine/k8s:1.28.3" + command = ["/bin/sh", "-c"] args = [<<-EOF - set -e + set -e + apk add --no-cache jq >/dev/null 2>&1 || trueAlternatively use a distro with bash+jq preinstalled. Without this fix, the init workflow never runs.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
modules/openbao/default/1.0/facets.yaml(1 hunks)modules/openbao/default/1.0/main.tf(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- modules/openbao/default/1.0/facets.yaml
🧰 Additional context used
🪛 Checkov (3.2.334)
modules/openbao/default/1.0/main.tf
[medium] 222-233: Ensure Terraform module sources use a commit hash
(CKV_TF_1)
[high] 222-233: Ensure Terraform module sources use a tag with a version number
(CKV_TF_2)
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
modules/openbao/default/1.0/README.md(1 hunks)modules/openbao/default/1.0/facets.yaml(1 hunks)
🧰 Additional context used
🪛 markdownlint-cli2 (0.18.1)
modules/openbao/default/1.0/README.md
19-19: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🔇 Additional comments (4)
modules/openbao/default/1.0/facets.yaml (2)
168-171: Outputs facet type appears correctly aligned.The outputs section now references
type: '@outputs/openbao', which aligns with the expected outputs facet name. This appears to address the previous review concern about the facet type/name mismatch. Assuming the outputs facet atoutputs/openbao/output.facets.yamldeclaresname: openbao, this should resolve correctly.
18-157: Schema spec and samples are well-structured.The spec section comprehensively defines all configuration options with appropriate types, defaults, and constraints. The sample policies demonstrate realistic usage patterns with proper HCL formatting and escape handling. The defaults (chart 0.18.4, 1 replica, raft storage, 10Gi) appear reasonable for both standalone and HA deployments.
Also applies to: 177-204
modules/openbao/default/1.0/README.md (2)
73-204: Documentation accurately reflects module design and is well-organized.The usage examples, configuration reference tables, and output descriptions align properly with the facets.yaml schema. Parameters (namespace, release_name, storage_type, server_replicas, server_resources, openbao.policies, openbao.values) are correctly documented with defaults matching the schema. The three example scenarios (standalone, HA, custom policies) progressively build complexity and demonstrate the module's range. Outputs section lists expected sensitive and non-sensitive values, and the policy configuration explanation correctly describes the service-account/role/policy binding pattern.
206-347: Security and operations guidance is production-ready and thorough.The Security Considerations section appropriately emphasizes backup of the unseal key, token rotation, RBAC scoping, and network-level controls. The Operations section provides practical kubectl commands for common tasks (accessing, authenticating, scaling, backup, recovery). Prerequisites are clear, limitations are realistic, and troubleshooting scenarios address real failure modes (pod readiness, RBAC, network connectivity, Raft joining). The advanced configuration section offers flexibility for custom Helm values and explains storage backend trade-offs.
| ``` | ||
| ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ | ||
| │ Random Key │───▶│ K8s Secret │───▶│ Helm Release │ | ||
| │ Generation │ │ (Unseal Key) │ │ (OpenBao Pods) │ | ||
| └─────────────────┘ └─────────────────┘ └─────────────────┘ | ||
| │ | ||
| ▼ | ||
| ┌─────────────────────────────────────────┐ | ||
| │ Kubernetes Init Job │ | ||
| │ 1. Initialize leader (openbao-0) │ | ||
| │ 2. Store root token & recovery keys │ | ||
| │ 3. Join Raft nodes (HA mode) │ | ||
| │ 4. Configure Kubernetes auth │ | ||
| │ 5. Enable KV v2 secrets engine │ | ||
| │ 6. Create custom policies & roles │ | ||
| └─────────────────────────────────────────┘ | ||
| │ | ||
| ▼ | ||
| ┌─────────────────────────────────────────┐ | ||
| │ Auto-Unsealed OpenBao Cluster │ | ||
| │ - Static seal with env var key │ | ||
| │ - Pods auto-unseal on restart │ | ||
| │ - Raft HA (if replicas > 1) │ | ||
| │ - Ready for secret management │ | ||
| └─────────────────────────────────────────┘ | ||
| ``` |
There was a problem hiding this comment.
Add language specifier to ASCII diagram fence.
Per markdownlint (MD040), fenced code blocks must have a language specifier. The ASCII diagram block should use ```text instead of just ```.
Apply this diff to fix the markdown lint violation:
-```
+```text
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
19-19: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
In modules/openbao/default/1.0/README.md around lines 19 to 44, the ASCII
diagram fenced block is missing a language specifier which violates markdownlint
MD040; update the opening fence from ``` to ```text (and ensure the closing
fence remains ```), so the block becomes a fenced code block with the "text"
language specifier to satisfy the linter.
Description
This PR includes openbao module which is used to store controlplane secrets with auto unseal feature
Module Details
${RELEASE_NAME}-init-keyswhere it stores root key and recovery keys. It takes care of joining the replica servers to raft cluster and auto unsealing them if any. Additionally it enables kubernetes auth method and also creates read-write and read policies for controlplane-service and release-pod respectively.Related issues
Task Id: https://app.clickup.com/t/86d0h99tt
Type of change
Checklist
masterbranchTesting
Release Link: https://facetsdemo.console.facets.cloud/capc/stack/infra-dev/releases/cluster/62e38a777ae44900010ef721/dialog/release-details/68ec9af3d4c8a2079dffa4da
server was auto-unsealed, manually added secrets
Release Link: https://facetsdemo.console.facets.cloud/capc/stack/infra-dev/releases/cluster/62e38a777ae44900010ef721/dialog/release-details/68ec9e4ad4c8a2079dffa994
Server 2 was auto-unsealed and secrets were also synced from server 1
Release Link: https://facetsdemo.console.facets.cloud/capc/stack/infra-dev/releases/cluster/62e38a777ae44900010ef721/dialog/release-details/68eca348d4c8a2079dffb300
servers were auto-unsealed
Reviewer instructions
Summary by CodeRabbit
New Features
Documentation