nordisk/Skidbladnir

.nornir/openbao-guide.md

# openbao — guide

> **Class:** `guide` · audience: a techie wiring an env to OpenBao. The *what* is in
> [`openbao-design.md`](openbao-design.md); step-by-step in
> [`openbao-for-idiots.md`](openbao-for-idiots.md).

## Enable the feature

```toml
skidbladnir = { path = "…", features = ["openbao"] }
```

Off by default — the offline core never compiles `reqwest`.

## From code

```rust
use skidbladnir::openbao::OpenBao;

let ob = OpenBao::from_env()?;              // VAULT_ADDR/BAO_ADDR + VAULT_TOKEN/BAO_TOKEN
ob.enable_kubernetes_auth()?;               // mount auth/kubernetes (idempotent)
ob.configure_kubernetes("https://kubernetes.default.svc")?;
ob.provision_env("test1", "test1-njord", "test1")?;   // read policy + role
```

`provision_env(env, sa, ns)` writes the env's read policy (`secret/data/<env>/*`)
and a k8s-auth role of the same name binding ServiceAccount `sa` in namespace `ns`.

## From the CLI (the example)

```sh
kubectl -n openbao port-forward svc/openbao 8200:8200 &
export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=$(python3 -c "import json,os;print(json.load(open(os.path.expanduser('~/.config/openbao/init.json')))['root_token'])")

cargo run --features openbao --example openbao-provision -- \
  lab:njord-lab:njord-lab test1:test1-njord:test1 test2:test2-njord:test2
```

Idempotent; re-run any time. (`--k8s-host URL` overrides the API address.)

## What this does NOT do (do these yourself)

1. **Write the values** — `tillsynia-admin vault-write --namespace <env> --secret <env>-njord`
   (lab uses `--path secret/data/lab/app` since ns `njord-lab` ≠ env `lab`).
2. **`system:auth-delegator` CRB** — `kubectl apply -f deploy/openbao/rbac.yaml`
   (login-time TokenReview needs it; RBAC grant, apply with approval).
3. **Install the Agent injector** —
   `helm upgrade --install openbao-injector openbao/openbao -n openbao
   --set server.enabled=false --set injector.enabled=true
   --set injector.externalVaultAddr=http://openbao.openbao.svc:8200`.
4. **Turn an env on** —
   `helm upgrade <env> deploy/helm/njord -n <ns> --reuse-values --set vault.enabled=true
   --set vault.role=<env> --set vault.secretPath=secret/data/<env>/app`.

Full turn-on runbook + prod caveat: Njord `deploy/openbao/README.md` §turn-on and
`.nornir/tillsynia-admin.md`.