feat: replace Infisical with OpenBao as OSS secrets backend#8
Merged
Conversation
nbrieussel
force-pushed
the
feat/001-replace-infisical-oss-secrets
branch
from
1e7f462 to
67fec5d
Compare
Deploys OpenBao (MPL 2.0) via ArgoCD app-of-apps with S3 state on
Scaleway Object Storage, so secrets survive full cluster destroy/recreate.
Key additions:
- platform/{local,scaleway}/openbao.yml — OpenBao Helm chart (0.28.4),
S3 backend pointing to backup-dev-id bucket, creds from K8s Secret
- platform/{local,scaleway}/external-secrets.yml — ESO (2.6.0)
- apps/openbao-init/ — in-house Helm chart: PostSync init/unseal Job
(reads/writes keys from S3), RBAC, per-app HCL policies, ESO
ClusterSecretStore; idempotent across boots
- clusters/{local,scaleway}/templates/openbao-init.yaml — ArgoCD
Applications wiring the init chart into the app-of-apps tree
- Sync-wave order: wave 0 openbao → wave 1 ESO → wave 2 openbao-init
- .github/workflows/ci.yml — 3 jobs: helm-lint, infisical-absent,
secrets-restore (destroy/recreate canary test against real Scaleway S3)
Cross-repo dependency: infra Terraform must create scaleway-s3-credentials
Secret in openbao namespace before ArgoCD first sync.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KoJ6zVHxYtUKtSNXinmct7
nbrieussel
force-pushed
the
feat/001-replace-infisical-oss-secrets
branch
from
67fec5d to
a458cd3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
backup-dev-id) — secrets survive full cluster destroy/recreateClusterSecretStoreArchitecture
Test plan
helm-lintjob: lint + render all chartsinfisical-absentjob:git grep -ri infisicalreturns no matchessecrets-restorejob: write canary → destroy cluster → recreate → assert canary restored (SC-001)Cross-repo dependency
The infra Terraform must create
scaleway-s3-credentialsSecret in theopenbaonamespace before ArgoCD first sync. Required keys:access_key,secret_key,bucket.Spec
Full design in
specs/001-replace-infisical-oss-secrets/(spec, plan, research, data-model, contracts, quickstart, tasks).🤖 Generated with Claude Code
https://claude.ai/code/session_01KoJ6zVHxYtUKtSNXinmct7