MTO Openbao extension adrs - #388
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| **Q2. Given namespace mode, what is the Tenant → OpenBao namespace mapping?** Two candidates: | ||
|
|
||
| - **1 Tenant = 1 OpenBao namespace** — the tenant's OpenBao namespace holds all of the tenant's k8s namespaces as paths and Kubernetes-auth roles inside it. |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
Consider removing “of” to be more concise (ALL_OF_THE[1])
Suggestions: all the
URL: https://languagetool.org/insights/post/wordiness/
Rule: https://community.languagetool.org/rule/show/ALL_OF_THE?lang=en-US&subId=1
Category: REDUNDANCY
|
@aayeshaarshad PR doc deploy will soon be available for review on https://stakater.github.io/mto-docs/openbao-adrs |
|
@aayeshaarshad Image is available for testing. |
|
@aayeshaarshad PR doc deploy will soon be available for review on https://stakater.github.io/mto-docs/openbao-adrs |
|
@aayeshaarshad Image is available for testing. |
| # Operator creates one key per k8s ns (name from layoutRef template), | ||
| # plus one `<tenant>-shared-<env>` key per tenant with >=2 namespaces | ||
| # (see Intra-tenant sharing). | ||
| keyType: aes256-gcm96 # aes256-gcm96 | chacha20-poly1305 | ed25519 | rsa-2048 | rsa-4096 | ecdsa-p256 | ... |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
Unpaired symbol: ‘"’ seems to be missing (EN_UNPAIRED_QUOTES)
URL: https://languagetool.org/insights/post/punctuation-guide/#what-are-parentheses
Rule: https://community.languagetool.org/rule/show/EN_UNPAIRED_QUOTES?lang=en-US
Category: PUNCTUATION
| - name: pki | ||
| type: pki | ||
| layoutRef: pkiMount | ||
| enabled: false # opt-in |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
Unpaired symbol: ‘"’ seems to be missing (EN_UNPAIRED_QUOTES)
URL: https://languagetool.org/insights/post/punctuation-guide/#what-are-parentheses
Rule: https://community.languagetool.org/rule/show/EN_UNPAIRED_QUOTES?lang=en-US
Category: PUNCTUATION
| intraTenantSharedRole: # materialized once per tenant with >=2 k8s ns (optional) | ||
| allowedDomains: ["*.{{ .tenant }}.svc.cluster.local"] | ||
| allowSubdomains: true | ||
| maxTTL: 720h |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
Unpaired symbol: ‘"’ seems to be missing (EN_UNPAIRED_QUOTES)
URL: https://languagetool.org/insights/post/punctuation-guide/#what-are-parentheses
Rule: https://community.languagetool.org/rule/show/EN_UNPAIRED_QUOTES?lang=en-US
Category: PUNCTUATION
| Always its own mount in both modes. One `OpenBao` CR can declare several (e.g. `pki-shared`, `pki-shared-partners`). | ||
|
|
||
| | `tenancy.mode=namespace` | `tenancy.mode=path` | | ||
| |---|---| |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
Unpaired symbol: ‘"’ seems to be missing (EN_UNPAIRED_QUOTES)
URL: https://languagetool.org/insights/post/punctuation-guide/#what-are-parentheses
Rule: https://community.languagetool.org/rule/show/EN_UNPAIRED_QUOTES?lang=en-US
Category: PUNCTUATION
| viewer: none | ||
|
|
||
| # transit: | ||
| # keyName: from-<W>-to-<R>-<env> # operator auto-fills if omitted |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
This word is normally spelled as one. (EN_COMPOUNDS_AUTO_FILLS)
Suggestions: autofills
Rule: https://community.languagetool.org/rule/show/EN_COMPOUNDS_AUTO_FILLS?lang=en-US
Category: MISC
| spec: | ||
| engineRef: transit | ||
| from: | ||
| tenant: team-a |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
Possible typo: you repeated a word (ENGLISH_WORD_REPEAT_RULE)
Suggestions: tenants
Rule: https://community.languagetool.org/rule/show/ENGLISH_WORD_REPEAT_RULE?lang=en-US
Category: MISC
| spec: | ||
| engineRef: pki-shared | ||
| from: | ||
| tenant: platform |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
Possible typo: you repeated a word (ENGLISH_WORD_REPEAT_RULE)
Suggestions: tenants
Rule: https://community.languagetool.org/rule/show/ENGLISH_WORD_REPEAT_RULE?lang=en-US
Category: MISC
|
|
||
| | Field | Type | Required | Description | | ||
| |---|---|---|---| | ||
| | `keyName` | string | yes | Transit key to share. Created if absent. Naming convention: `from-<W>-to-<R>-<env>` for directional, `shared-all-<env>` for broadcast — operator auto-fills if omitted. | |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
This word is normally spelled as one. (EN_COMPOUNDS_AUTO_FILLS)
Suggestions: autofills
Rule: https://community.languagetool.org/rule/show/EN_COMPOUNDS_AUTO_FILLS?lang=en-US
Category: MISC
|
|
||
| In every `pki/` and `pki-<tenant>/` mount (inside any namespace), these | ||
| endpoints are on OpenBao's unauthenticated-paths list and do **not** | ||
| require a policy grant: |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
Two consecutive dots (DOUBLE_PUNCTUATION)
Suggestions: ., …
URL: https://languagetool.org/insights/post/punctuation-guide/#what-are-periods
Rule: https://community.languagetool.org/rule/show/DOUBLE_PUNCTUATION?lang=en-US
Category: PUNCTUATION
| ### `share-team-a-to-team-b-writer` | ||
|
|
||
| ```hcl | ||
| path "kv/data/shared/dev/from-team-a/to-team-b/*" { capabilities = ["create","read","update"] } |
There was a problem hiding this comment.
[LanguageTool] reported by reviewdog 🐶
Use a comma before ‘so’ if it connects two independent clauses (unless they are closely connected and short). (COMMA_COMPOUND_SENTENCE_2[1])
Suggestions: , so
URL: https://languagetool.org/insights/post/comma-before-and/
Rule: https://community.languagetool.org/rule/show/COMMA_COMPOUND_SENTENCE_2?lang=en-US&subId=1
Category: PUNCTUATION
|
@aayeshaarshad PR doc deploy was successfully deleted from branch pull-request-deployments |
1 participant
No description provided.