Sienna Meridian Satterwhite
d32d1435f9
- data: CNPG cluster tuning, OpenBao values, OpenSearch deployment fixes, OpenSearch PVC, barman vault secret for S3 backup credentials - storage: SeaweedFS filer updates (s3.json via secret subPath), PVC for filer persistent storage - devtools: Gitea values (SSH service, custom theme), gitea-theme-cm ConfigMap - ory: add kratos-selfservice-urls.yaml for self-service flow URLs - media: LiveKit values updated (TURN config, STUN, resource limits) - vso: kustomization cleanup
82 lines
1.9 KiB
YAML
82 lines
1.9 KiB
YAML
# OpenBao Helm values — standalone single-instance mode.
|
|
# Root token + unseal key stored in K8s secret `openbao-keys` (created by init script).
|
|
|
|
global:
|
|
tlsDisable: true
|
|
|
|
injector:
|
|
enabled: true
|
|
agentDefaults:
|
|
cpuLimit: "250m"
|
|
cpuRequest: "50m"
|
|
memLimit: "64Mi"
|
|
memRequest: "32Mi"
|
|
|
|
server:
|
|
image:
|
|
registry: quay.io
|
|
repository: openbao/openbao
|
|
|
|
# Disable anti-affinity — single-node cluster.
|
|
affinity: ""
|
|
|
|
standalone:
|
|
enabled: true
|
|
config: |
|
|
ui = true
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
}
|
|
storage "file" {
|
|
path = "/openbao/data"
|
|
}
|
|
|
|
dataStorage:
|
|
enabled: true
|
|
size: 1Gi
|
|
|
|
resources:
|
|
limits:
|
|
memory: 128Mi
|
|
requests:
|
|
memory: 64Mi
|
|
cpu: 50m
|
|
|
|
# Auto-unseal sidecar: reads unseal key from K8s secret and unseals on restart.
|
|
extraContainers:
|
|
- name: auto-unseal
|
|
image: quay.io/openbao/openbao
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
export BAO_ADDR=http://127.0.0.1:8200
|
|
echo "auto-unseal: waiting for openbao to start..."
|
|
until bao status -format=json 2>/dev/null; do sleep 2; done
|
|
while true; do
|
|
if [ -f /openbao/unseal/key ]; then
|
|
SEALED=$(bao status -format=json 2>/dev/null | grep '"sealed"' | grep -c 'true')
|
|
if [ "$SEALED" = "1" ]; then
|
|
echo "auto-unseal: unsealing..."
|
|
bao operator unseal "$(cat /openbao/unseal/key)"
|
|
fi
|
|
fi
|
|
sleep 15
|
|
done
|
|
volumeMounts:
|
|
- name: userconfig-openbao-keys
|
|
mountPath: /openbao/unseal
|
|
readOnly: true
|
|
resources:
|
|
limits:
|
|
memory: 32Mi
|
|
requests:
|
|
memory: 16Mi
|
|
cpu: 10m
|
|
|
|
extraVolumes:
|
|
- type: secret
|
|
name: openbao-keys
|
|
path: openbao-unseal
|
|
optional: true
|