feat(secrets): OpenBao + External Secrets Operator — SOPS migration phase 1 #168

2026-07-13T16:26:47Z

claude-bot commented

2026-07-13 16:26:47 +00:00

Deploys the foundation for moving k8s secrets out of git, per today's decision:

kubernetes/infrastructure/openbao/ — OpenBao 2.5.x (chart >=0.28.4 <0.29.0), single-node integrated raft on 5Gi ceph-block, UI/API at openbao.k.renner.uno only (deliberately no public renner.uno host — see comment in ingress.yaml). Agent injector disabled (ESO does delivery). disableWait on the HelmRelease because a fresh pod is 0/1 Ready until init+unseal.
kubernetes/infrastructure/external-secrets/ — ESO chart >=2.7.0 <3.0.0, CRDs CreateReplace, major bound deliberately (CRD API moves between majors).
Namespaces openbao + external-secrets (the empty security ns was considered; dedicated per-component namespaces match the existing convention — say the word if you'd rather consolidate).
kubernetes/MIGRATION-sops-openbao.md — the full phased migration draft: init/unseal procedure (keys into the GPG pass store), phase-2 OpenBao config + ClusterSecretStore (deliberately NOT in this PR: it cannot go Ready before manual init, and would freeze the infrastructure-crds wait gate — the 2026-07-13 incident shape), per-file checklist of all 31 sops files in blast-radius order, DR/rebuild runbook, and the rule that the age key is retired only at the very end.

Merging this is safe/no-op for everything running: nothing consumes OpenBao or ESO yet; the OpenBao pod will sit sealed (0/1 Ready) until bao operator init per the doc.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

Deploys the foundation for moving k8s secrets out of git, per today's decision: - **kubernetes/infrastructure/openbao/** — OpenBao 2.5.x (chart >=0.28.4 <0.29.0), single-node integrated raft on 5Gi ceph-block, UI/API at **openbao.k.renner.uno only** (deliberately no public renner.uno host — see comment in ingress.yaml). Agent injector disabled (ESO does delivery). `disableWait` on the HelmRelease because a fresh pod is 0/1 Ready until init+unseal. - **kubernetes/infrastructure/external-secrets/** — ESO chart >=2.7.0 <3.0.0, CRDs CreateReplace, major bound deliberately (CRD API moves between majors). - Namespaces `openbao` + `external-secrets` (the empty `security` ns was considered; dedicated per-component namespaces match the existing convention — say the word if you'd rather consolidate). - **kubernetes/MIGRATION-sops-openbao.md** — the full phased migration draft: init/unseal procedure (keys into the GPG `pass` store), phase-2 OpenBao config + ClusterSecretStore (deliberately NOT in this PR: it cannot go Ready before manual init, and would freeze the infrastructure-crds wait gate — the 2026-07-13 incident shape), per-file checklist of all 31 sops files in blast-radius order, DR/rebuild runbook, and the rule that the age key is retired only at the very end. **Merging this is safe/no-op for everything running**: nothing consumes OpenBao or ESO yet; the OpenBao pod will sit sealed (0/1 Ready) until `bao operator init` per the doc. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

claude-bot added 1 commit 2026-07-13 16:26:47 +00:00

feat(secrets): deploy OpenBao + External Secrets Operator (SOPS migration phase 1) be59c4ae37

Single-node raft OpenBao (5Gi ceph-block, UI at openbao.k.renner.uno,
internal-only ingress) and ESO 2.x. No ClusterSecretStore yet — it can
only turn Ready after manual init/unseal, and committing it now would
freeze the infrastructure-crds wait gate (2026-07-13 incident shape).
Full phased plan incl. per-file checklist and DR runbook in
kubernetes/MIGRATION-sops-openbao.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

k.renner merged commit 5e3c1fcff9 into master

2026-07-13 16:30:30 +00:00

k.renner referenced this issue from a commit

2026-07-13 16:30:30 +00:00

Merge pull request 'feat(secrets): OpenBao + External Secrets Operator — SOPS migration phase 1' (#168) from openbao-eso into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#168