Skip to content

Add openbao proxy

Dmytro Biryukov requested to merge dbiryukov/add-openbao-proxy into main

Related to: gitlab#494888

What does this merge request do and why?

We have to start OpenBao behind the proxy by default - sample proxy confirugartion - gitlab!162431 (merged)

How to set up and validate locally

You can configure the OpenBao to run locally in GDK.

To configure:

  1. Set the BAO_ADDR variable in your environment
   export BAO_ADDR='http://gdk.test:8200'
  1. Run gdk config set openbao.enabled true.
  2. Run gdk config set openbao_proxy.enabled true.
  3. Run gdk reconfigure.
  4. Run rake openbao/config.hcl to create a configuration file
  5. Run openbao/proxy_config.hcl to create a proxy configuration file
  6. Run gdk start openbao.
  7. Run gdk bao configure to unseal the vault
=> "✅ OpenBao has been unsealed successfully"
=> "The root token is: s.xxxxxxxxxxxxxxx"
  1. Set the BAO_TOKEN variable in your environment to use bao CLI. Run export BAO_TOKEN=s.xxxxxxxx
  2. Run bao auth enable approle
  3. Run bao write auth/approle/role/project_secret_engines_manager token_policies=manage_projects_secret_engines
  4. Run bao read -field=role_id auth/approle/role/project_secret_engines_manager/role-id \> openbao/roleid
  5. Run bao write -field=wrapping_token -f -wrap-ttl=1h auth/approle/role/project_secret_engines_manager/secret-id > openbao/secretid
  6. Run OpenBaoProxy with gdk start openbao-proxy

Impacted categories

The following categories relate to this merge request:

Merge request checklist

  • This change is backward compatible. If not, please include steps to communicate to our users.
  • Tests added for new functionality. If not, please raise an issue to follow-up.
  • Documentation added/updated, if needed.
  • Announcement added, if change is notable.
  • gdk doctor test added, if needed.
  • Add the ~highlight label if this MR should be included in the CHANGELOG.md.
Edited by Dmytro Biryukov

Merge request reports

Loading