feat(openbao): add healthcheck and openbao-init service to override example#14
Open
vitormattos wants to merge 1 commit intomainfrom
Open
feat(openbao): add healthcheck and openbao-init service to override example#14vitormattos wants to merge 1 commit intomainfrom
vitormattos wants to merge 1 commit intomainfrom
Conversation
The previous example lacked:
- healthcheck on the openbao service (required for depends_on condition)
- openbao-init one-shot service to create the 'nfse' KV v2 mount and
enable AppRole auth automatically on first start
- networks: internal on mailpit service
- env var interpolation form (${VAR:-default}) for the dev token
Without this init step, any module operation that writes or reads PFX
secrets fails because the 'nfse' mount does not exist in OpenBao.
Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problema
Ao subir o ambiente com
docker-compose.override.yml, o OpenBao iniciava em modo dev sem criar o mount KV v2nfse/. Qualquer operação do módulo NFS-e que tentasse gravar ou ler segredos (ex: senha do PFX) falhava silenciosamente porque o mount não existia.Além disso, o serviço
openbaonão tinhahealthcheck, então não era possível garantir que outros serviços esperassem ele estar pronto.O que foi corrigido
No exemplo do README:
openbao(verifica/v1/sys/healthvia HTTP a cada 5s)openbao-initadicionado:openbaoestar saudável (condition: service_healthy)bao secrets enable -path=nfse kv-v2ebao auth enable approle|| true) — seguros em restartrestart: on-failurepara não ficar em loop depois que o init completa com sucesso${VAR:-default})networks: internaladicionado aomailpitComo testar