Skip to content

Fixes for installation of openbao for automation #1886

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: stackhpc/2025.1
Choose a base branch
from
Draft

Fixes for installation of openbao for automation #1886

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions etc/kayobe/ansible/deploy-openbao-kayobe-automation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,23 +36,24 @@
ansible.builtin.import_role:
name: stackhpc.hashicorp.openbao
vars:
openbao_config_dir: "/opt/kayobe/vault"
openbao_api_addr: "http://127.0.0.1:8200"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The openbao_api_addr variable is defined with the http:// protocol prefix. However, later in the file (lines 56, 67, and 72), the http:// prefix is added again when using this variable. This results in an invalid URL like http://http://127.0.0.1:8200, which will cause tasks to fail. To fix this, the protocol prefix should be removed from this variable definition. This will make the variable contain only the address, and the protocol can be prepended where needed, as is done in the rest of the file.

        openbao_api_addr: "127.0.0.1:8200"

openbao_config_dir: "/opt/kayobe/openbao"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

This path has been correctly updated for OpenBao. However, a related task on lines 24-27, named Ensure /opt/kayobe/vault exists, still creates the old /opt/kayobe/vault directory. This task should be updated to create /opt/kayobe/openbao to ensure consistency and prevent potential failures.

openbao_cluster_name: "kayobe-automation"
copy_self_signed_ca: false
openbao_write_keys_file: true
openbao_write_keys_file_path: "{{ kayobe_env_config_path }}/vault/kayobe-automation-keys.json"
openbao_write_keys_file_path: "{{ kayobe_env_config_path }}/openbao/kayobe-automation-keys.json"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

This file path has been correctly updated for OpenBao. However, a related task on lines 30-33, named Ensure vault directory exists in environment, still creates the old .../vault directory in the environment path. This task should be updated to create the .../openbao directory to prevent failures when writing the keys file specified here.


- name: Include OpenBao keys
ansible.builtin.include_vars:
file: "{{ kayobe_env_config_path }}/vault/kayobe-automation-keys.json"
file: "{{ kayobe_env_config_path }}/openbao/kayobe-automation-keys.json"
name: openbao_keys
tags: always

- name: Import Vault unseal role
ansible.builtin.import_role:
name: stackhpc.hashicorp.vault_unseal
vars:
vault_api_addr: "{{ openbao_api_addr }}"
vault_api_addr: "http://{{ openbao_api_addr }}"
vault_unseal_token: "{{ openbao_keys.root_token }}"
vault_unseal_keys: "{{ openbao_keys.keys_base64 }}"
vault_unseal_verify: false
Expand All @@ -63,12 +64,12 @@
ansible.legacy.hashivault_secret_engine:
name: kayobe-automation
backend: kv
url: "{{ openbao_api_addr }}"
url: "http://{{ openbao_api_addr }}"
token: "{{ openbao_keys.root_token }}"

- name: Ensure secret store is present
community.hashi_vault.vault_write:
url: "{{ openbao_api_addr }}"
url: "http://{{ openbao_api_addr }}"
token: "{{ openbao_keys.root_token }}"
path: kayobe-automation/{{ kayobe_environment }}
data:
Expand Down
Loading