Initialize OpenBao Service by norbertgruszka · Pull Request #630 · vshn/appcat

norbertgruszka · 2026-03-31T15:20:56Z

Summary

Initialize OpenBao Service. The goal is to provide users with an option to setup HA OpenBao Cluster using Appcat.

Initial implementation contains:

Auto generated Kubernetes API
Deployment step
HCL generator
Self-signed TLS certificates

The service is not yet ready for production use. Further development will follow.

How to test?

Create kindev environment with at least 3 nodes. For now, the OpenBao Cluster starts in HA.
Create newvshnopenbaos.vshn.appcat.vshn.io resource.

apiVersion: vshn.appcat.vshn.io/v1
kind: VSHNOpenBao
metadata:
  name: openbao-test
spec:
  parameters:
    security:
      deletionProtection: false
  writeConnectionSecretToRef:
    name: "openbao-test"

Search for newly created namespace with openbao name included. Use bao operator init -tls-skip-verify to initialize the cluster manually with kubectl exec command.
The cluster should be operational.

Checklist

Update tests.
Link this PR to related issues.
Merge with /merge comment.

Component PR: vshn/component-appcat#1128

github-actions · 2026-03-31T15:28:28Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/672215

github-actions · 2026-04-01T09:33:07Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/672411

github-actions · 2026-04-01T09:38:11Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/672412

github-actions · 2026-04-02T08:27:35Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/672986

github-actions · 2026-04-02T08:31:58Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/672990

github-actions · 2026-04-13T13:51:39Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/675964

github-actions · 2026-04-13T14:35:15Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/675972

github-actions · 2026-04-16T11:53:20Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/678330

github-actions · 2026-04-17T09:04:51Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/678806

Kidswiss

The code looks good. Just a few remarks.

I haven't tested it yet, but will do some tests later.

Search for newly created namespace with openbao name included. Use bao operator init -tls-skip-verify to initialize the cluster manually with kubectl exec command.

One idea: this should probably be a post-install hook in the helm chart, since it's still part of the provisioning.

Kidswiss · 2026-04-17T11:45:49Z

+// VSHNOpenBaoServiceSpec contains OpenBao DBaaS specific properties
+type VSHNOpenBaoServiceSpec struct {
+	// +kubebuilder:validation:Enum=<TBD>
+	// +kubebuilder:default=<TBD>


Should probably be defined before release.

The Version field was just a placeholder. The version is set in Components Appcat.

Kidswiss · 2026-04-17T11:47:30Z

+	Version string `json:"version,omitempty"`
+
+	// Openbaosettings contains additional OpenBao settings.
+	Openbaosettings string `json:"openbaosettings,omitempty"`


Is this really just a string? Or only a placeholder? Usually settings are modelled with a map[string]any

That was a placeholder too, so I removed it for now. We'll add it back later probably with better defined type.

Kidswiss · 2026-04-17T11:51:30Z

+			withIssuerOfTypeSelfSigned(),
+		},
+	}
+	selfSignedIssuer := createIssuer(ns, serviceName+tlsSelfSignedIssuerSuffix, selfSignedIssuerOpts)


I guess common.CreateCertificate() wasn't flexible enough to handle this?

I'm wondering if it would make sense to refactor it make it more flexible.

I didn't know common.CreateCertificate() exists. I think we were looking at Redis and certificates are created differently there.

I update the code, now it's using common.CreateCertificate()

Yeah, some older services might not use the common library because they were migrated from legacy crossplane compositions and are thus stuck in a kind of limbo.

github-actions · 2026-04-23T08:24:37Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/680229

github-actions · 2026-04-23T08:56:43Z

Check out Your new Comp-Functions diff at: https://git.vshn.net/appcat/comp-func-pipelines/-/pipelines/680341

Kidswiss

I tried to create an instance, but I struggle to get the cluster initialized properly.

My steps:

k -n vshn-openbao-openbao-test-v54vf exec -it openbao-test-v54vf-0 -- sh

bao operator init -tls-skip-verify
bao operator unseal -tls-skip-verify

k -n vshn-openbao-openbao-test-v54vf exec -it openbao-test-v54vf-1 -- sh

bao operator unseal -tls-skip-verify
Unseal Key (will be hidden):
Error unsealing: Error making API request.

URL: PUT https://127.0.0.1:8200/v1/sys/unseal
Code: 400. Errors:

* Vault is not initialized

The first pod looks fine, the others throw this error. According to the openbao docs bao operator init has to be run only once.

Checking the config within the pod I see this:

cat userconfig/openbao-hcl-config/config.hcl
ui           = true
log_level    = "info"
log_format   = "json"
cluster_name = "openbao-test-v54vf"
api_addr     = "https://openbao-test-v54vf:8200"
cluster_addr = "https://openbao-test-v54vf:8201"

listener "tcp" {
  address         = "[::]:8200"
  cluster_address = "[::]:8201"
  tls_disable     = false
  tls_cert_file   = "/openbao/userconfig/openbao-tls/tls.crt"
  tls_key_file    = "/openbao/userconfig/openbao-tls/tls.key"
}

storage "raft" {
  path = "/openbao/data"
}

Isn't there supposed to be something to tell the instance where its peers are?

Kidswiss · 2026-04-23T11:16:20Z

+type VSHNOpenBaoSizeSpec struct {
+


This one seems unused. At least according to the linter.

Kidswiss · 2026-04-23T11:19:53Z

+// GetPDBLabels returns the labels to be used for the PodDisruptionBudget
+// it should match one unique label od pod running in instanceNamespace
+// without this, the PDB will match all pods
+func (v *VSHNOpenBao) GetPDBLabels() map[string]string {


Does the helm chart you're using already deploy PDBs? If not setting the labels to match the pods and then calling common.AddPDBSettings() will automagically deploy them. But I think the instances parameter needs to be set for them to work...

Kidswiss · 2026-04-23T12:34:39Z

+		"server": map[string]any{
+			"ha": map[string]any{
+				"enabled": true,
+				"config":  "# Config provided via external file\n",


I'm wondering why the config is provided via an external file?

Initialize OpenBao Service API

8d8da09

norbertgruszka mentioned this pull request Mar 31, 2026

OpenBao: Init #499

Closed

3 tasks

vshnbot mentioned this pull request Mar 31, 2026

Initialize OpenBao Service vshn/component-appcat#1128

Open

3 tasks

norbertgruszka added 3 commits April 1, 2026 11:04

Register OpenBao new types

e9c399d

Register OpenBao Webhook

96dedd1

Setup empty deploy function for OpenBao Service

9d5770e

Lint and Test OpenBao Code

946054d

norbertgruszka added 7 commits April 1, 2026 15:07

Generate HCL config and add missing webhook config

3cbdd9a

Rename OpenBao Service Details file

0b06a74

Rename OpenBao Service Details file

e58a8c3

Setup TLS for in-cluster communication in OpenBao Service

dcb6a6e

Setup OpenBao Deploy function

bb2d1fd

Refinment and test review

deacd53

Run go mod tidy

0061058

norbertgruszka requested a review from ioboi April 2, 2026 13:09

ioboi added the minor label Apr 10, 2026

ioboi added 2 commits April 13, 2026 16:30

Explicit plural for VSHNOpenBaos

88b9b1a

Rename to "vshn_openbao.go"

8285fe7

ioboi force-pushed the feat/init-openabo-service branch from 875b55d to 8285fe7 Compare April 13, 2026 14:31

fix plural name

b8d896a

norbertgruszka added 2 commits April 16, 2026 16:03

Disable billing

0312c93

Enable TLS by default and get composite object

c82db9d

norbertgruszka requested review from Kidswiss and TheBigLee April 17, 2026 09:25

Kidswiss requested changes Apr 17, 2026

View reviewed changes

norbertgruszka added 2 commits April 23, 2026 10:17

Use common.CreateTLSCerts

7da1bee

Import vshnopenbao at cmd/functinos.go

aefd0a6

norbertgruszka added 3 commits April 23, 2026 10:28

Remove placeholder fields from OpenBao Spec field

a97ad28

Lint

2e99530

Re-generated crds

6080e1e

lieneluksika requested a review from Kidswiss April 23, 2026 09:09

Kidswiss reviewed Apr 23, 2026

View reviewed changes

Conversation

norbertgruszka commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How to test?

Checklist

Uh oh!

github-actions Bot commented Mar 31, 2026 • edited by ioboi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 1, 2026 • edited by ioboi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 1, 2026 • edited by ioboi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 2, 2026 • edited by ioboi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 2, 2026 • edited by ioboi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 13, 2026 • edited by ioboi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 13, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 17, 2026

Uh oh!

Kidswiss left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

Kidswiss left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

norbertgruszka commented Mar 31, 2026 •

edited

Loading

github-actions Bot commented Mar 31, 2026 •

edited by ioboi

Loading

github-actions Bot commented Apr 1, 2026 •

edited by ioboi

Loading

github-actions Bot commented Apr 1, 2026 •

edited by ioboi

Loading

github-actions Bot commented Apr 2, 2026 •

edited by ioboi

Loading

github-actions Bot commented Apr 2, 2026 •

edited by ioboi

Loading

github-actions Bot commented Apr 13, 2026 •

edited by ioboi

Loading