Skip to content

Quickstart: EU OpenBao, Port and beacon

Published matched release

Use chart 1.0.359, operator v0.13.209, wrapper/init v0.2.207 and Linux host Port v0.4.133. Use released CLI v0.19.176 with this matched set. Hosted enrollment is not currently available.

The proven path is Linux host Port + customer relay + US cluster + EU store. Chart 1.0.358 measured delivery, explicit rotation, denial cases, outages and enforcing NetworkPolicies on one operator, GKE COS 6.12.105+/Calico. Chart 1.0.359 passed delivery without app resources, with operator NetworkPolicies disabled; that full combination with policies enabled is untested. Both runs used pre-release CLI builds and a private-CA IP relay; released CLI v0.19.176, DNS and public-CA relays were not run end to end. Skip charts 1.0.357 and 1.0.358 when installing. The operator adds 64Mi to a manifest memory limit, covering about 42 MB of injected tmpfs. The OOM case was 1Mi in the manifest, effective 65Mi. Keep the effective budget well above the measured 67–69 MB floor plus app headroom. See the procedure for sizing and evidence. Managed S3 proxy, Volume Shield and Linux 7.0 are unsupported; DB proxy has not been shown to work here. Use one wrapped container per Pod and set cloudtaser.io/containers (default first container). Host Port broker CA rotation has no supported runbook. Stock Ubuntu 24.04 GCE booted 7.0.0-1014-gcp; check node uname -r, not just the LTS image name. Issued tokens can outlive Pod deletion until TTL, up to 15 minutes. Install in cloudtaser-system.

Start with the complete customer procedure. It is the installation sequence after the signed-artifact and host prerequisites; do not begin with an empty target install or configure a direct store endpoint for this topology.

  1. Obtain the matched release, qualified node substrate, explicit kubeconfig, verified source/relay TLS and your own self-hosted tenant.
  2. On the EU VM, render/review/run the generated managed OpenBao installer; protect the root token/unseal shares. Install the signed Port binary.
  3. Complete your relay/source administrators' private tenant issuance to both source and relay, after the source mount exists.
  4. Create the workload/reviewer namespaces and SAs, pass TokenReview from the EU host, then prepare/render/provision/activate the exact authority.
  5. Prepare a finite host approval and keep the supervised Port launch attached. Port logs in locally to OpenBao and dials the enrolled beacon.
  6. Apply the matched production/platform/site cluster profiles without waiting for readiness before private introduction. Deliver the registered bundle with target activate-beacon-auth --operator-introduction-file.
  7. Apply the published policy/Deployment/Service manifest with token auth and one selected container. Verify consumption through the in-cluster Service.
  8. Change a synthetic KV value and explicitly rotate the selected Deployment; verify v2, then test outage/recovery and uninstall safely.

Commands and custody

The full procedure provides the installation commands and names the private enrollment/introduction handoffs. It keeps tenant keys, salts and introductions out of Helm and Kubernetes objects. Do not copy secrets into argv or application manifests, use protected-container exec to prove delivery, or replace the managed tenant with a single-tenant ctb1 token.

An existing workload's PID, Ready condition and application Service must be checked separately during outages. Static-KV rotation through the beacon is explicit in this procedure; outage continuity needs application-level evidence for the matched release.

Other topologies

Direct mode has a separate reachable-store contract and platform limits; see Supported Paths and the in-cluster guide. It is not a replacement for qualifying this EU VM + Port + beacon path.