Skip to content

OpenBao Helm Values

The published cloudtaser/cloudtaser-openbao chart 0.2.17 is maintained in cloudtaser-helm. It deploys the secret store; it is separate from the Linux host Port and from the unified cloudtaser operator chart.

Installation scope

For the measured Linux host Port + customer relay + US cluster + EU store path, follow the host-Port installation procedure. That procedure uses an existing EU-hosted OpenBao store, not a Kubernetes Port. The CLI's source install port defaults to Kubernetes; select --type=linux explicitly when generating the host installer.

cloudtaser-cli source install bao deploys OpenBao only. The CLI sets bootstrap.enabled=false, leaving initialization, unsealing and provisioning to the administrator. The direct Helm default is bootstrap.enabled=true; its post-install Job runs the bootstrap lifecycle and requires administrator custody of the unseal shares. Follow the OpenBao listener PKI lifecycle for administrator custody, initialization, trust publication and verification. An OpenBao deployment does not establish application delivery or qualify Kubernetes Port. See Supported Paths.

TLS and bootstrap

The published chart defaults to tls.mode=openbao-pki. Its CA signing key stays inside OpenBao's barrier; each server's listener key stays in pod memory. ConfigMaps carry public trust material. cert-manager is an optional mode, not the production default. The optional cert-manager and development self-signed modes store CA signing material in Kubernetes Secrets and have a different storage boundary.

Keep verified TLS and NetworkPolicy enabled. Configure the actual Kubernetes API Service and endpoint CIDRs and ports, including the port after Service DNAT. Keep administrator unseal material under the custody process described in the PKI lifecycle; do not put root tokens or unseal keys in Helm values or Kubernetes Secrets. The bootstrap image is cloudtaser-bootstrap, not a CLI container. An image tag override must be reviewed with its digest; prefer the chart's matched defaults.

Defaults from the published chart

The table is generated from the same published chart source selected by the documentation cohort. It lists the principal TLS, server and bootstrap inputs; it is not the entire chart schema. Recognition or a default value does not establish a qualified deployment.

Value Default from the published chart
bootstrap.auth.path "kubernetes"
bootstrap.enabled true
bootstrap.image.digest "630c733aa0f24cf42ba06b6c493102384a5e1b97693e4c414dbf37ea974d5fc9"
bootstrap.image.pullPolicy "IfNotPresent"
bootstrap.image.repository "europe-west4-docker.pkg.dev/skipopsmain/cloudtaser/cloudtaser-bootstrap"
bootstrap.image.tag "v0.4.133"
bootstrap.kv.path "secret"
bootstrap.policy.kvReadPaths ["secret/data/*", "secret/metadata/*"]
bootstrap.policy.name "cloudtaser"
bootstrap.role.boundServiceAccountNames "cloudtaser-wrapper"
bootstrap.role.boundServiceAccountNamespaces "default"
bootstrap.role.name "cloudtaser"
bootstrap.role.ttl "1h"
bootstrap.shamir.shares 5
bootstrap.shamir.threshold 3
bootstrap.unsealMode "shamir-manual"
namespace ""
openbao.injector.enabled false
openbao.server.auditStorage.enabled true
openbao.server.auditStorage.size "10Gi"
openbao.server.dataStorage.enabled true
openbao.server.dataStorage.size "10Gi"
openbao.server.ha.enabled true
openbao.server.ha.raft.enabled true
openbao.server.ha.replicas 3
openbao.server.resources.limits.cpu "1"
openbao.server.resources.limits.memory "512Mi"
openbao.server.resources.requests.cpu "250m"
openbao.server.resources.requests.memory "256Mi"
tls.certManager.enabled false
tls.enabled true
tls.mode "openbao-pki"
tls.openbaoPki.leafTTL "24h"
tls.openbaoPki.renewBefore "8h"
tls.openbaoPki.trustBundleConfigMap "openbao-tls-trust-bundle"

The default workload role namespace is a chart input, not an instruction to deploy protected workloads into an unlabelled namespace. Set exact workload ServiceAccounts and namespaces, enroll the namespace with the operator's cloudtaser.io/inject=true label, and use canonical pod annotation keys.