Added openbao secrets management and phaseout of bitnami for CloudNative PG

helm/openbao-values.yaml

@@ -0,0 +1,123 @@
+# Railiance S3 OpenBao platform secrets service.
+#
+# This file intentionally contains no secret material. OpenBao initialization
+# creates unseal keys and the initial root token; handle those outside Git
+# during the bootstrap ceremony documented in docs/openbao.md.
+
+global:
+  namespace: openbao
+  tlsDisable: true
+
+injector:
+  enabled: false
+
+server:
+  enabled: true
+  logLevel: info
+  logFormat: json
+
+  image:
+    registry: quay.io
+    repository: openbao/openbao
+    pullPolicy: IfNotPresent
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+  ingress:
+    enabled: false
+
+  authDelegator:
+    enabled: true
+
+  # Single-node Railiance01 bootstrap. Remove this override and scale
+  # server.ha.replicas when Railiance02/03 join with distributed storage.
+  affinity: ""
+
+  readinessProbe:
+    enabled: true
+    path: /v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204
+    port: 8200
+
+  livenessProbe:
+    enabled: true
+    path: /v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204
+    port: 8200
+    initialDelaySeconds: 60
+
+  networkPolicy:
+    enabled: true
+    ingress:
+      - from:
+          - namespaceSelector: {}
+        ports:
+          - port: 8200
+            protocol: TCP
+          - port: 8201
+            protocol: TCP
+
+  dataStorage:
+    enabled: true
+    size: 5Gi
+    storageClass: local-path
+    accessMode: ReadWriteOnce
+
+  auditStorage:
+    enabled: true
+    size: 2Gi
+    storageClass: local-path
+    accessMode: ReadWriteOnce
+
+  standalone:
+    enabled: false
+
+  ha:
+    enabled: true
+    replicas: 1
+    disruptionBudget:
+      enabled: false
+    raft:
+      enabled: true
+      setNodeId: true
+      config: |
+        ui = true
+
+        listener "tcp" {
+          tls_disable = 1
+          address = "[::]:8200"
+          cluster_address = "[::]:8201"
+
+          telemetry {
+            unauthenticated_metrics_access = "true"
+          }
+        }
+
+        storage "raft" {
+          path = "/openbao/data"
+        }
+
+        service_registration "kubernetes" {}
+
+        telemetry {
+          prometheus_retention_time = "30s"
+          disable_hostname = true
+        }
+
+  serviceAccount:
+    create: true
+    name: openbao
+    serviceDiscovery:
+      enabled: true
+
+ui:
+  enabled: true
+  serviceType: ClusterIP
+  activeOpenbaoPodOnly: false
+
+csi:
+  enabled: false