Repository navigation
feat(deploy): manage operator secrets in the OpenBao web UI - #14
Merged
Merged
Conversation
Replace the gitignored env files and their push script with OpenBao's web UI. moon run deploy:openbao forwards OpenBao to localhost, logs in through Kubernetes auth as a new snapflow-operator role and prints a one-hour token. That role can create, edit, roll back and delete only the operator secrets (api, alerts, backups, cloudflare-dns and edges/*); it cannot read the keyrings and platform credentials the configure job generates or change OpenBao itself. Closing the session asks External Secrets to sync at once. The deploy:secrets task, push-secrets.sh, the OpenBao shell and its session library are removed.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
github-actions
Bot
added
the
documentation
BryanLawless
added a commit
that referenced
this pull request
Nov 5, 2026
Pull requests are now squash-merged directly into main; dev, its workflow, sync-dev and the dev ruleset are retired. Pushes to main run CI, publish the changed images and run release-please, and Flux image automation pins digests on main. Also brings in the changes merged into dev since the last promotion: - feat(deploy): manage operator secrets in the OpenBao web UI (#14) - feat(deploy): add dynamic DNS, a host firewall and read-only database access (#15) - chore: remove the docs folder (#16) - chore: remove dead code, configuration and unused runtime options (#17) - fix(api): restore the executable bit on the GeoIP download script (#19) - ci: rebuild the api image when the GeoIP download script changes (#20)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Operator secrets are now managed in OpenBao's web UI instead of gitignored env files pushed by a script.
moon run deploy:openbaoforwards OpenBao tolocalhost:18200, logs in through Kubernetes auth as a newsnapflow-operatorrole and prints a one-hour token to sign in with. OpenBao stays cluster-internal; the UI is never routed through Traefik.snapflow-operatorpolicy (written by the configure job) can create, edit, roll back and delete only the operator secrets:snapflow/api,alerts,backups,cloudflare-dnsandedges/*. It cannot read the keyrings and platform credentials the job generates, write any other path, or change OpenBao itself. The old shell used the far broadersnapflow-configurerole.force-sync, so edits reach the cluster at once instead of at the hourly refresh, as the push did.ui = truein the OpenBao server config.deploy:secrets,push-secrets.sh,openbao-shell.shandlib/openbao-session.sh.The
/deploy/secrets/production/gitignore entry stays until the operator has moved its existing local values into OpenBao and deleted the folder, so those files can never be committed by accident.Testing
configure.shwrites it, an operator token could create, update, read, roll back and deletesnapflow/apiandsnapflow/edges/home, and listsnapflow/andsnapflow/edges/; it was denied reading or writingsnapflow/api/encryption-keyringandsnapflow/platform/redis, writing other paths, writing policies and listing mounts.deploy/scripts/validate.shpasses for every stage; shellcheck is clean on the new and changed scripts.