# openbao — for idiots (turn an env on, step by step)
> **Class:** `idiot`. Every step, nothing assumed. Goal: **make a Njord env read its
> secrets from OpenBao instead of a baked-in k8s Secret.** If you know Rust, read
> [`openbao-guide.md`](openbao-guide.md).
There are **four** things. Skidbladnir's `openbao` module does **step 2**; the rest
are one command each. Do it on **test1** first (it's disposable). Never touch prod.
### 0. Get a shell that can reach the cluster + vault
```sh
export KUBECONFIG=~/njord-kubeconfig-current.yaml # or Njord/drift/lab/kubeconfig
kubectl -n openbao port-forward svc/openbao 8200:8200 & # leave running
export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=$(python3 -c "import json,os;print(json.load(open(os.path.expanduser('~/.config/openbao/init.json')))['root_token'])")
```
### 1. Put the secret VALUES in the vault (tillsynia-admin)
```sh
tillsynia-admin vault-write --namespace test1 --secret test1-njord
```
Writes `secret/data/test1/app` from the running Secret. (Lab: add `--path secret/data/lab/app`.)
### 2. Provision the STRUCTURE (this module)
```sh
cargo run --features openbao --example openbao-provision -- test1:test1-njord:test1
```
Enables the k8s auth method + writes test1's read policy and role. **Idempotent.**
### 3. Let the vault trust the cluster's identity check (one-time, whole cluster)
```sh
kubectl apply -f deploy/openbao/rbac.yaml # the system:auth-delegator CRB
```
### 4. Install the injector (one-time) + turn the env on
```sh
helm repo add openbao https://openbao.github.io/openbao-helm && helm repo update
helm upgrade --install openbao-injector openbao/openbao -n openbao \
--set server.enabled=false --set injector.enabled=true \
--set injector.externalVaultAddr=http://openbao.openbao.svc:8200
helm upgrade test1 deploy/helm/njord -n test1 --reuse-values \
--set vault.enabled=true --set vault.role=test1 --set vault.secretPath=secret/data/test1/app
```
### Did it work?
```sh
kubectl -n test1 get pod # the app pod should have an extra vault-agent container
kubectl -n test1 logs deploy/test1-njord -c vault-agent | tail
```
The pod sources `/vault/secrets/app.env` before it boots. **Broke?** Instant undo:
`helm upgrade test1 … --set vault.enabled=false`. Once test1 is proven, repeat for
test2 and lab.