panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

为 sandbox 接入 OpenBao External Secrets #99

Merged
panxiao81 merged 2 commits from feat/sandbox-external-secrets into main 2026-09-18 17:41:51 +00:00
Conversation 0 Commits 2 Files Changed 24
+320 -19
panxiao81 commented 2026-09-18 17:38:32 +00:00
Owner
Copy Link
Copy Source

内容

  • 在 sandbox 集群部署独立 ESO 2.8.0，并拆分 operator/config 两层确保首次安装 CRD 顺序正确
  • 为 sandbox 创建独立 OpenBao Kubernetes auth backend，提交公开 K3s CA
  • 不保存 reviewer JWT：ESO 使用短期 SA JWT，并仅绑定 system:auth-delegator
  • sandbox policy 只允许读取共享的 kv/k8s/opensandbox-api
  • OpenSandbox server 从 ExternalSecret 获取 API key，移除无认证 bootstrap 模式
  • runner 侧的 Secret 投影留给 runner 项目

已执行

  • 通过本机 SPIFFE local-development 身份生成并写入共享 API key，值未输出或落盘
  • Terraform plan：4 add / 0 change / 0 destroy
  • Terraform apply：4 added
  • apply 后 plan：No changes
  • Terraform validate、Helm lint 与 chart render 通过
## 内容 - 在 sandbox 集群部署独立 ESO 2.8.0，并拆分 operator/config 两层确保首次安装 CRD 顺序正确 - 为 sandbox 创建独立 OpenBao Kubernetes auth backend，提交公开 K3s CA - 不保存 reviewer JWT：ESO 使用短期 SA JWT，并仅绑定 system:auth-delegator - sandbox policy 只允许读取共享的 kv/k8s/opensandbox-api - OpenSandbox server 从 ExternalSecret 获取 API key，移除无认证 bootstrap 模式 - runner 侧的 Secret 投影留给 runner 项目 ## 已执行 - 通过本机 SPIFFE local-development 身份生成并写入共享 API key，值未输出或落盘 - Terraform plan：4 add / 0 change / 0 destroy - Terraform apply：4 added - apply 后 plan：No changes - Terraform validate、Helm lint 与 chart render 通过
panxiao81 added 1 commit 2026-09-18 17:38:33 +00:00
为 sandbox 接入 OpenBao External Secrets
yaml / yaml (pull_request) Successful in 17s
Details
terraform / validate (pull_request) Successful in 49s
Details
e0e629794b
panxiao81 added 1 commit 2026-09-18 17:40:25 +00:00
记录 sandbox ESO 当前状态
yaml / yaml (pull_request) Successful in 16s
Details
terraform / validate (pull_request) Successful in 39s
Details
159a75b710
panxiao81 merged commit 8290082fb4 into main 2026-09-18 17:41:51 +00:00
panxiao81 deleted branch feat/sandbox-external-secrets 2026-09-18 17:41:51 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#99