feat(secrets): ClusterSecretStore + declarative audit — SOPS migration phase 2 #170

2026-07-13T16:46:53Z

claude-bot commented

2026-07-13 16:46:53 +00:00

Phase 2 of kubernetes/MIGRATION-sops-openbao.md. The manual half is already done (2026-07-13, this session): OpenBao initialized (1 share/1 threshold, unseal key + root token in the freshly bootstrapped GPG pass store), unsealed, kv-v2 mounted at homelab/, kubernetes auth configured, eso-read policy + eso role bound to the external-secrets SA.

This PR adds the declarative rest:

post-crds/openbao-clustersecretstore.yaml — ClusterSecretStore openbao (ESO vault provider, external-secrets.io/v1 per the deployed CRDs). Safe for the wait gate now that the backend is initialized and reachable.
audit device in the OpenBao server HCL — bao audit enable is API-disabled in OpenBao 2.5, audit is declarative-only. log_raw deliberately OFF: raw mode would ship plaintext secret values to Loki. Merging triggers a pod restart (config change) → one manual unseal afterwards (bao operator unseal with the key from pass); I'll handle it.
migration doc updated accordingly (audit note, pass-store bootstrap + GPG-backup warning).

⚠️ Still on you: the new GPG key 6B8F...52A4 has no passphrase and no off-machine backup yet — set a passphrase (gpg --edit-key) and back it up; it now guards the unseal key.

After merge I'll verify the store goes Ready and run a smoke-test ExternalSecret before starting the phase-3 warm-up migrations.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

Phase 2 of kubernetes/MIGRATION-sops-openbao.md. **The manual half is already done** (2026-07-13, this session): OpenBao initialized (1 share/1 threshold, unseal key + root token in the freshly bootstrapped GPG `pass` store), unsealed, kv-v2 mounted at `homelab/`, kubernetes auth configured, `eso-read` policy + `eso` role bound to the `external-secrets` SA. This PR adds the declarative rest: - `post-crds/openbao-clustersecretstore.yaml` — ClusterSecretStore `openbao` (ESO vault provider, `external-secrets.io/v1` per the deployed CRDs). Safe for the wait gate now that the backend is initialized and reachable. - audit device in the OpenBao server HCL — `bao audit enable` is API-disabled in OpenBao 2.5, audit is declarative-only. `log_raw` deliberately OFF: raw mode would ship plaintext secret values to Loki. **Merging triggers a pod restart (config change) → one manual unseal afterwards** (`bao operator unseal` with the key from `pass`); I'll handle it. - migration doc updated accordingly (audit note, pass-store bootstrap + GPG-backup warning). ⚠️ Still on you: the new GPG key `6B8F...52A4` has **no passphrase and no off-machine backup yet** — set a passphrase (`gpg --edit-key`) and back it up; it now guards the unseal key. After merge I'll verify the store goes Ready and run a smoke-test ExternalSecret before starting the phase-3 warm-up migrations. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

claude-bot added 1 commit 2026-07-13 16:46:53 +00:00

feat(secrets): ClusterSecretStore + declarative audit (SOPS migration phase 2) 98346b370e

OpenBao was initialized and configured today (kv-v2 at homelab/, k8s
auth, eso-read policy + role bound to the external-secrets SA); the
store can therefore turn Ready and no longer endangers the post-crds
wait gate. Audit device moves into the server HCL because OpenBao 2.5
rejects API-managed audit devices; log_raw stays off so Loki only ever
sees HMAC-redacted values.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

k.renner merged commit 5991607e1c into master

2026-07-13 17:00:03 +00:00

k.renner referenced this issue from a commit

2026-07-13 17:00:04 +00:00

Merge pull request 'feat(secrets): ClusterSecretStore + declarative audit — SOPS migration phase 2' (#170) from openbao-phase2 into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#170