The Guide to OpenBao - Kubernetes Integration - Part 10

oc new-project myapp
oc create serviceaccount myapp-sa -n myapp

# Allow the myapp identity to read KV v2 data (and list metadata) under secret/myapp/
bao policy write myapp - <<'EOF'
path "secret/data/myapp/*" {
  capabilities = ["read", "list"]
}
path "secret/metadata/myapp/*" {
  capabilities = ["list"]
}
EOF

# Map ServiceAccount myapp-sa in namespace myapp to that policy via Kubernetes auth
bao write auth/kubernetes/role/myapp \
  bound_service_account_names=myapp-sa \
  bound_service_account_namespaces=myapp \
  policies=myapp \
  ttl=1h

# Seed sample secrets for Injector / CSI / ESO examples later in this article
bao kv put secret/myapp/config db_host=pg.example.com db_password=s3cret
bao kv put secret/myapp/api key=api-key-123

1. Pod created with vault.hashicorp.com/* annotations
2. Mutating webhook intercepts admission
3. vault-agent-init (and optionally vault-agent sidecar) injected
4. Agent authenticates with the pod ServiceAccount JWT (Kubernetes auth)
5. Agent retrieves secrets and writes templated files
6. Application reads from /vault/secrets/
7. Sidecar renews tokens / leases and re-renders as needed

injector:
  enabled: true
  replicas: 2

oc get pods -n openbao -l app.kubernetes.io/name=openbao-agent-injector

# Check webhook
oc get mutatingwebhookconfigurations | grep openbao

oc create secret generic openbao-ca -n myapp \
  --from-literal=ca.crt="$(oc get secret openbao-ca-secret -n openbao -o jsonpath='{.data.ca\.crt}' | base64 -d)" \
  --dry-run=client -o yaml | oc apply -f -

cat <<EOF | oc apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
      annotations:
        vault.hashicorp.com/agent-inject: "true" (1)
        vault.hashicorp.com/role: "myapp" (2)
        vault.hashicorp.com/tls-secret: "openbao-ca" (3)
        vault.hashicorp.com/ca-cert: "/vault/tls/ca.crt"
        vault.hashicorp.com/agent-inject-secret-config.txt: "secret/data/myapp/config" (4)
        vault.hashicorp.com/agent-inject-template-config.txt: |
          {{- with secret "secret/data/myapp/config" -}}
          DB_HOST={{ .Data.data.db_host }}
          DB_PASSWORD={{ .Data.data.db_password }}
          {{- end }}
        vault.hashicorp.com/agent-inject-secret-api-key: "secret/data/myapp/api"
        vault.hashicorp.com/agent-inject-template-api-key: |
          {{- with secret "secret/data/myapp/api" -}}
          {{ .Data.data.key }}
          {{- end }}
    spec:
      serviceAccountName: myapp-sa (5)
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          image: curlimages/curl:latest
          command: ["sleep", "infinity"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
EOF

oc get pods -n myapp
# Expect READY 2/2 (app + vault-agent) when the sidecar is enabled

oc get pods -n myapp -o jsonpath='{.items[0].spec.containers[*].name}{"\n"}'
# Expected: app vault-agent

oc get pods -n myapp -o jsonpath='{.items[0].spec.initContainers[*].name}{"\n"}'
# Expected: vault-agent-init

oc exec -it deploy/myapp -c app -n myapp -- cat /vault/secrets/config.txt
# Expected: DB_HOST=pg.example.com
#           DB_PASSWORD=s3cret

oc exec -it deploy/myapp -c app -n myapp -- cat /vault/secrets/api-key
# Expected: api-key-123

annotations:
  vault.hashicorp.com/agent-inject: "true" (1)
  vault.hashicorp.com/agent-pre-populate-only: "true" (2)
  vault.hashicorp.com/role: "myapp" (3)
  vault.hashicorp.com/tls-secret: "openbao-ca" (4)
  vault.hashicorp.com/ca-cert: "/vault/tls/ca.crt"
  vault.hashicorp.com/agent-inject-secret-config.txt: "secret/data/myapp/config" (5)

apiVersion: operator.openshift.io/v1
kind: ClusterCSIDriver
metadata:
  name: secrets-store.csi.k8s.io (1)
spec:
  managementState: Managed

oc adm policy add-scc-to-user privileged -z openbao-csi-provider -n openbao

helm upgrade --install openbao openbao/openbao -n openbao --reuse-values \
  --set csi.enabled=true \
  --set csi.daemonSet.securityContext.container.privileged=true \
  --set 'csi.volumes[0].name=openbao-ca' \
  --set 'csi.volumes[0].secret.secretName=openbao-ca-secret' \
  --set 'csi.volumeMounts[0].name=openbao-ca' \
  --set 'csi.volumeMounts[0].mountPath=/openbao/tls' \
  --set 'csi.volumeMounts[0].readOnly=true' \
  --set 'csi.agent.extraArgs[0]=-ca-path=/openbao/tls/ca.crt'

oc get ds -n openbao openbao-csi-provider
# Desired/Ready should match the node count

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: openbao-secrets
  namespace: myapp
spec:
  provider: openbao (1)
  parameters:
    baoAddress: "https://openbao.openbao.svc:8200" (2)
    baoCACertPath: "/openbao/tls/ca.crt" (3)
    roleName: "myapp" (4)
    objects: |
      - objectName: "db_password"
        secretPath: "secret/data/myapp/config"
        secretKey: "db_password"
      - objectName: "api_key"
        secretPath: "secret/data/myapp/api"
        secretKey: "key"
  secretObjects: (5)
    - secretName: myapp-synced
      type: Opaque
      data:
        - objectName: db_password
          key: db_password
        - objectName: api_key
          key: api_key

apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  namespace: myapp
spec:
  serviceAccountName: myapp-sa (1)
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: curlimages/curl:latest
      command: ["sleep", "infinity"]
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      volumeMounts:
        - name: secrets
          mountPath: /mnt/secrets (2)
          readOnly: true
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: myapp-synced (3)
              key: db_password
  volumes:
    - name: secrets
      csi:
        driver: secrets-store.csi.k8s.io (4)
        readOnly: true
        volumeAttributes:
          secretProviderClass: openbao-secrets (5)

oc exec -it myapp-pod -n myapp -- ls -la /mnt/secrets/
oc exec -it myapp-pod -n myapp -- cat /mnt/secrets/db_password

apiVersion: operator.openshift.io/v1alpha1
kind: ExternalSecretsConfig
metadata:
  name: cluster
spec:
  controllerConfig:
    networkPolicies:
      - name: allow-openbao-egress
        componentName: ExternalSecretsCoreController
        egress:
          - ports:
              - protocol: TCP
                port: 8200
            to:
              - namespaceSelector:
                  matchLabels:
                    kubernetes.io/metadata.name: openbao

oc get pods -n external-secrets

# Base64 CA PEM (one line) for caBundle
oc get secret openbao-ca-secret -n openbao -o jsonpath='{.data.ca\.crt}{"\n"}'

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: openbao-backend
  namespace: myapp
spec:
  provider:
    vault: (1)
      server: "https://openbao.openbao.svc:8200" (2)
      path: "secret" (3)
      version: "v2"
      caBundle: "<BASE64_CA_PEM>" (4)
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "myapp" (5)
          serviceAccountRef:
            name: myapp-sa

oc get secretstore openbao-backend -n myapp
# STATUS should indicate Ready / Valid

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: myapp-secrets
  namespace: myapp
spec:
  refreshInterval: "5m" (1)
  secretStoreRef:
    name: openbao-backend
    kind: SecretStore
  target:
    name: myapp-secrets (2)
    creationPolicy: Owner
    template:
      type: Opaque
  data:
    - secretKey: db_host (3)
      remoteRef:
        key: myapp/config (4)
        property: db_host
    - secretKey: db_password
      remoteRef:
        key: myapp/config
        property: db_password
    - secretKey: api_key
      remoteRef:
        key: myapp/api
        property: key

oc get ExternalSecret myapp-secrets -n myapp
# STATUS should be SecretSynced

oc get secret myapp-secrets -n myapp -o jsonpath='{.data}' | \
  jq 'to_entries[] | {key: .key, value: (.value | @base64d)}'
# Should show db_host, db_password, api_key

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: myapp-all-config
  namespace: myapp
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: openbao-backend
    kind: SecretStore
  target:
    name: myapp-all-config
  dataFrom:
    - extract:
        key: myapp/config

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-eso
  namespace: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp-eso
  template:
    metadata:
      labels:
        app: myapp-eso
    spec:
      containers:
        - name: app
          image: registry.access.redhat.com/ubi9/ubi-minimal:latest
          command: ["sleep", "infinity"] (1)
          env:
            - name: DB_HOST
              valueFrom:
                secretKeyRef:
                  name: myapp-secrets (2)
                  key: db_host
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: myapp-secrets
                  key: db_password
          volumeMounts:
            - name: config
              mountPath: /etc/config
              readOnly: true
      volumes:
        - name: config
          secret:
            secretName: myapp-secrets (3)

# Environment variables from secretKeyRef
oc exec -n myapp deploy/myapp-eso -- printenv DB_HOST DB_PASSWORD
# Expect the decoded values from myapp-secrets

# Files from the secret volume (one file per key)
oc exec -n myapp deploy/myapp-eso -- ls -l /etc/config
# Expect db_host, db_password, api_key

# Rewrite all fields the ExternalSecret reads (KV v2 put replaces the version)
bao kv put --cas=<latest_version> secret/myapp/config \
  db_host=pg.example.com \
  db_password=newP@ssw0rd

# Force an immediate sync (do not wait for refreshInterval)
oc annotate externalsecret myapp-secrets -n myapp force-sync=$(date +%s) --overwrite

oc get externalsecret -n myapp
# Expect SecretSynced / Ready

oc get secret myapp-secrets -n myapp -o jsonpath='{.data}' | \
  jq 'to_entries[] | {key: .key, value: (.value | @base64d)}'

# Bind roles to a single namespace and SA
bao write auth/kubernetes/role/myapp \
  bound_service_account_names=myapp-sa \
  bound_service_account_namespaces=myapp \
  policies=myapp \
  ttl=1h

# Prefer short TTLs for dynamic database roles
bao write database/roles/myapp-readonly \
  default_ttl=1h \
  max_ttl=4h