Let Sloppenheimer create a secret bootstrap job

Author: bastjan

README.md

@@ -1,3 +1,13 @@
 # Bundle OpenBao
 
 A Helmetica bundle chart for OpenBao.
+
+## Seal Secret Bootstrap
+
+This chart includes a Helm `post-install` hook job that creates a seal secret with a random value.
+
+- The job only runs on install (not upgrade).
+- If the secret already exists, the job exits without changing it.
+- Configure it through `sealSecret.*` in `values.yaml`.
+
+Important: `sealSecret.name` must match `openbao.server.extraSecretEnvironmentVars[].secretName`.

templates/seal-secret-install-job.yaml

@@ -0,0 +1,83 @@
+{{- if .Values.sealSecret.enabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-seal-secret-bootstrap
+  annotations:
+    helm.sh/hook: post-install
+    helm.sh/hook-weight: "-10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-seal-secret-bootstrap
+  annotations:
+    helm.sh/hook: post-install
+    helm.sh/hook-weight: "-10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-seal-secret-bootstrap
+  annotations:
+    helm.sh/hook: post-install
+    helm.sh/hook-weight: "-10"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-seal-secret-bootstrap
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Release.Name }}-seal-secret-bootstrap
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .Release.Name }}-seal-secret-bootstrap
+  annotations:
+    helm.sh/hook: post-install
+    helm.sh/hook-weight: "0"
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backoffLimit: 1
+  template:
+    spec:
+      serviceAccountName: {{ .Release.Name }}-seal-secret-bootstrap
+      restartPolicy: Never
+      containers:
+        - name: create-seal-secret
+          image: {{ .Values.sealSecret.job.image | quote }}
+          imagePullPolicy: {{ .Values.sealSecret.job.imagePullPolicy | quote }}
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              secret_name="{{ .Values.sealSecret.name }}"
+              secret_key="{{ .Values.sealSecret.key }}"
+              value_length="{{ .Values.sealSecret.length }}"
+
+              if kubectl get secret "$secret_name" >/dev/null 2>&1; then
+                echo "Secret $secret_name already exists; leaving it unchanged."
+                exit 0
+              fi
+
+              secret_value="$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c "$value_length")"
+              cat <<EOF | kubectl create -f -
+              apiVersion: v1
+              kind: Secret
+              metadata:
+                name: "${secret_name}"
+              type: Opaque
+              immutable: true
+              stringData:
+                "${secret_key}": "${secret_value}"
+              EOF
+              echo "Created secret $secret_name."
+{{- end }}

values.yaml

@@ -2,6 +2,21 @@ backup:
   # backup retention in days
   retention: 6
 
+'#sealSecret':
+  export: false
+sealSecret:
+  # Enable one-time bootstrap job that creates the secret on install.
+  enabled: true
+  # Must match openbao.server.extraSecretEnvironmentVars.secretName.
+  name: dev-seal
+  # Key used inside the secret data.
+  key: SEAL_SECRET
+  # Random value length generated by the job.
+  length: 64
+  job:
+    image: quay.io/appuio/oc:v4.21
+    imagePullPolicy: IfNotPresent
+
 '#openbao':
   export: false
 openbao: