From 3db9636062d596d90526ba25882824b590b1d0b2 Mon Sep 17 00:00:00 2001 From: znerol2 <6800371+znerol2@users.noreply.github.com> Date: Thu, 12 Nov 2026 17:55:17 +0100 Subject: [PATCH] fix(openbao): name the CA in the unseal wrapper's TLS guidance The OpenBao pods now trust the CA that signs their listener certificate (ca.crt), not the certificate itself, and a renewed certificate reaches a running pod through the cert-manager play's reload instead of a restart. Update the wrapper's TLS comment and its exit-7 checklist to match. Refs dmfdeploy/dmfdeploy#879 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com> --- bin/unseal-openbao.sh | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/bin/unseal-openbao.sh b/bin/unseal-openbao.sh index 3884de1..fdbdfe9 100755 --- a/bin/unseal-openbao.sh +++ b/bin/unseal-openbao.sh @@ -16,10 +16,11 @@ # logs stream content. # # TLS: every OpenBao call runs `bao` inside the pod, where the pod spec sets -# BAO_ADDR=https://127.0.0.1:8200 and BAO_CACERT to the certificate the pod -# serves (issued for 127.0.0.1). bao verifies that certificate. The wrapper -# clears any *_SKIP_VERIFY variable for each call and has no path that skips -# verification. A TLS failure stops the run with exit 7 and says what to check. +# BAO_ADDR=https://127.0.0.1:8200 and BAO_CACERT to the CA that signed the +# certificate the pod serves (issued for 127.0.0.1). bao verifies that +# certificate against the CA. The wrapper clears any *_SKIP_VERIFY variable for +# each call and has no path that skips verification. A TLS failure stops the +# run with exit 7 and says what to check. # # Procedure (3-of-5 quorum, the routine break-glass path): # share 1 — JuiceFS /share-1.json (.key, base64) @@ -239,10 +240,11 @@ die_tls() { err "The wrapper never skips certificate verification. Check that:" err " - the openbao-tls certificate is ready and current:" err " ssh $SSH_TARGET 'sudo kubectl -n $OPENBAO_NAMESPACE get certificate,secret'" - err " - BAO_CACERT in the pod names the certificate the pod serves" - err " (pod spec default: /openbao/config/tls/tls.crt)" + err " - BAO_CACERT in the pod names the CA that signed the certificate the pod serves" + err " (pod spec default: /openbao/config/tls/ca.crt)" err " - the certificate covers the BAO_ADDR host (pod spec default: 127.0.0.1)" - err " - the pod restarted after the last certificate rotation" + err " - 320-cert-manager.yml ran after the last certificate renewal, so the pod" + err " serves the current certificate (the play reloads it in each pod)" exit 7 }