Jean-Gabriel Gill-Couture
ebd65b0d09
OpenBaoDeploymentSecretGrants replaces the per-device entity-policy backend (ADR-025): one policy deployment-<name> attached to each allowed group's external identity group — O(groups) writes per deployment change, request-time binding for existing tokens, group + JWT-mount alias created on first grant so grants precede first login. OpenbaoJwtAuth grows groups_claim, token_type (fleet roles use batch: zero storage writes per login, natural expiry is the membership sync) and jwt_validation_pubkeys so e2e can validate against a static test key with no live IdP; the PEM is single-quoted for the pod-exec shell. Chart values disable the agent injector and authDelegator: both unused and both install cluster-scoped RBAC that outlives namespace cleanup and breaks the next install.
example-openbao
Installs a standalone OpenBao instance and makes it immediately usable as a
harmony_config store: deploy → init → unseal → KV v2. Depending on your
environment it either spins up a local k3d cluster or targets the remote
cluster KUBECONFIG points at.
Configuration comes from ConfigClient (HARMONY_CONFIG_OpenbaoInstallConfig
env JSON → OpenBao → interactive prompt). The only required field is host.
# Non-interactive: provide the config as JSON.
export HARMONY_CONFIG_OpenbaoInstallConfig='{
"host": "secrets-stg.cb1.nationtech.io",
"namespace": "openbao",
"release": "openbao",
"openshift": true,
"tls_issuer": "letsencrypt-prod"
}'
cargo run -p example-openbao -- --yes
cargo run -p example-openbao -- --list lists the scores without touching the
cluster. Run without HARMONY_CONFIG_* to be prompted for each field.
Optional features compose from config presence:
| Config field(s) | Effect |
|---|---|
tls_issuer |
cert-manager edge TLS on the ingress (omit for plain HTTP) |
oidc_issuer + oidc_audience |
JWT auth + a harmony role scoped to secret/harmony/* |
After it runs, point harmony_config at it with OPENBAO_URL=https://<host>
and OPENBAO_TOKEN=<cached root token> (the root token is at
~/.local/share/harmony/openbao/unseal-keys.json). Once oidc_* is set, SSO
callers can authenticate via HARMONY_SSO_* instead of the root token.