ADR 0043 - Managed OpenBao Service Implementation

apiVersion: vshn.appcat.vshn.io/v1
kind: VSHNOpenBao
metadata:
  name: my-openbao
  namespace: my-namespace
spec:
  parameters:
    # Service configuration
    service:
      version: "2.1.0"  # OpenBao version (enum of supported versions)
      fqdn: "openbao.example.com"  # Fully qualified domain name
      serviceLevel: guaranteed  # besteffort or guaranteed
      openBaoSettings:
        # Auto-unseal configuration (optional)
        # Enables automatic unsealing using external key management systems
        # Only one provider should be configured at a time
        autoUnseal:
          awsKmsSecretRef: ""  # Reference to secret containing AWS KMS credentials and configuration
          azureKeyVaultSecretRef: ""  # Reference to secret containing Azure Key Vault credentials and configuration
          gcpKmsSecretRef: ""  # Reference to secret containing GCP Cloud KMS credentials and configuration
          transitSecretRef: ""  # Reference to secret containing connection details to another Vault/OpenBao instance

    # Number of OpenBao instances
    # For guaranteed serviceLevel: must be 3
    # For besteffort serviceLevel: can be 1 or 3
    instances: 3

    # Sizing
    size:
      plan: standard  # Resource plan: small, standard, large
      requests:
        cpu: "2"
        memory: "4Gi"
      disk: 20Gi  # Raft storage volume size per replica
      storageClass: ""  # Optional storage class override

    # Backup and restore configuration (using K8up)
    backup:
      enabled: true
      schedule: "0 2 * * *"  # Cron schedule for Raft snapshots
      retention:
        keepLast: 2
        keepHourly: 2
        keepDaily: 7
        keepWeekly: 4
        keepMonthly: 3
    restore:
      claimName: ""
      backupName: ""

    # Maintenance window
    maintenance:
      dayOfWeek: Tuesday  # enum: Monday-Sunday
      timeOfDay: "22:00"  # HH:MM format in UTC

    # Monitoring
    monitoring:
      alertmanagerConfigRef: ""
      alertmanagerConfigSecretRef: {}
      alertmanagerConfigTemplate: {}
      email: ""

  # Unseal keys and root token secret reference
  # This secret will contain the unseal keys and root token generated during initialization
  writeConnectionSecretToRef:
    name: openbao-unseal-keys

apiVersion: v1
kind: Secret
metadata:
  name: openbao-unseal-keys
data:
  UNSEAL_KEY_1: <base64-encoded-key>
  UNSEAL_KEY_2: <base64-encoded-key>
  UNSEAL_KEY_3: <base64-encoded-key>
  UNSEAL_KEY_4: <base64-encoded-key>
  UNSEAL_KEY_5: <base64-encoded-key>
  ROOT_TOKEN: <base64-encoded-root-token>

apiVersion: v1
kind: Secret
metadata:
  name: openbao-awskms-config
type: Opaque
stringData:
  region: "us-east-1"
  access_key: "AKIAIOSFODNN7EXAMPLE"
  secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
  kms_key_id: "19ec80b0-dfdd-4d97-8164-c6examplekey"
  endpoint: "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com"