Add OpenBao/ESO PoC for dynamic OpenStack credentials - #1
Open
mikejoh wants to merge 3 commits into
Open
Conversation
Bootstrap the workload cluster kube-proxy-free with a temporary Flannel overlay, then have ArgoCD install Cilium (kubeProxyReplacement) and run a one-shot Job that removes Flannel and re-IPs existing pods. Also syncs k8s-devstack01.yaml to CAPI v1beta2 core kinds and bumps Kubernetes/clusterctl versions and the HA topology in the README. Assisted-by: Claude/claude-sonnet-5
…et0) Replaces the tutorial's static clouds.yaml username/password with a broker chain: OpenBao's vault-plugin-secrets-openstack mints short-lived, project-scoped Application Credentials from one narrowly-scoped root user, External Secrets Operator (authenticating to OpenBao via its own ServiceAccount token, no static token either) reshapes them into a clouds.yaml Secret, and CAPO's OpenStackClusterIdentity consumes it. Verified end-to-end against a real DevStack: minted credentials authenticate, rotate on refresh, and get revoked in Keystone on expiry; a minimal OpenStackCluster reconciled real Neutron resources using only the dynamic credential. Assisted-by: Claude Code/Sonnet 5
Adds templates/cluster-chart: a Helm chart parameterizing everything the capo-poc/ manifests hand-wrote (Vault roleset, VaultDynamicSecret, ExternalSecret, OpenStackClusterIdentity, Cluster/OpenStackCluster) by cluster name, plus argocd/apps/clusters-appset.yaml so a new cluster is "add a clusters/<name>.yaml, commit" rather than a manual apply. The Vault roleset is created by a chart-hooked Job (not a manifest, since rolesets are a Vault API object) authenticating via a new, dedicated, write-only OpenBao role (cluster-bootstrapper) — deliberately separate from ESO's read-only role, which is now widened to a glob so it covers every cluster without per-cluster edits. Verified by instantiating a second, independent cluster (capo-poc-2) through the chart: roleset auto-created, ExternalSecret synced, and a real second Neutron network/router/security-group came up in DevStack. Assisted-by: Claude Code/Sonnet 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
clouds.yamlusername/password with a dynamic broker chain: OpenBao'svault-plugin-secrets-openstackmints short-lived, project-scoped OpenStack Application Credentials from one narrowly-scoped root user (openbao/), instead of a per-cluster user account with a password that never expires.capo-poc/01-external-secret.yaml) pulls those credentials via aVaultDynamicSecretgenerator, authenticating to OpenBao with its own ServiceAccount token (OpenBao'skubernetesauth method) — no static token for that leg either — and reshapes them into aclouds.yamlSecret.OpenStackClusterIdentity(capo-poc/02-cluster-identity.yaml) consumes that Secret; a minimal, infra-onlyOpenStackCluster/Cluster(capo-poc/03-openstackcluster.yaml, noMachineDeployment/control plane on purpose) provescapo-controllercan reconcile real Neutron resources with it.openbao/andcapo-poc/directories and how to run this on top of steps 1-18.Test plan
Verified end-to-end locally against a real DevStack (see README steps 19-22):
bao read openstack/creds/capo-poc-membermints a real Application Credential, confirmed viaopenstack application credential listopenstack network listsucceeds using only the minted id/secret)ExternalSecretsyncs on first try (SecretSynced), noSecretStoreneededOpenStackClusterreachesREADY: true, real network/subnet/router/security-group/floating-IP created in thecapo-pocprojectapplication_credential_idin the Secret changes everyrefreshInterval; old credentials disappear from Keystone once their lease expires (Vault-driven revoke)image-builderrun); Vault-down failure mode🤖 Generated with Claude Code