From 1b8e3726b156785c687a092063ac08888b564921 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Tue, 21 Jul 2026 11:37:41 +0200 Subject: [PATCH] fix(openbao): enable AWS KMS auto-unseal on scaleway MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit platform/scaleway/openbao.yml never got the extraSecretEnvironmentVars + seal "awskms" blocks that platform/local/openbao.yml already has, so OpenBao fell back to Shamir sealing and stayed sealed forever after every cluster (re)start — nobody was around to run the manual unseal. The k8s Secret + IAM/KMS side were already wired up correctly on the infrastructure repo side; only this Helm values gap was missing. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43 --- platform/scaleway/openbao.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/platform/scaleway/openbao.yml b/platform/scaleway/openbao.yml index 897fe9d..64981a1 100644 --- a/platform/scaleway/openbao.yml +++ b/platform/scaleway/openbao.yml @@ -17,6 +17,17 @@ spec: server: ha: enabled: false + # AWS credentials the awskms seal authenticates with. OpenBao must read + # these at startup to unseal — they cannot come from OpenBao itself + # (chicken-and-egg). Secret created out-of-band by 02-cluster/scaleway + # terraform; values originate from 03-backup/scaleway kms.tf. + extraSecretEnvironmentVars: + - envName: AWS_ACCESS_KEY_ID + secretName: openbao-unseal-aws + secretKey: AWS_ACCESS_KEY_ID + - envName: AWS_SECRET_ACCESS_KEY + secretName: openbao-unseal-aws + secretKey: AWS_SECRET_ACCESS_KEY standalone: config: | ui = true @@ -28,6 +39,13 @@ spec: path = "/openbao/data" node_id = "openbao-0" } + # Auto-unseal via AWS KMS. region + kms_key_id are non-secret + # (the IAM creds above gate access). On first `bao operator init` + # this yields RECOVERY keys, not unseal keys — store them safely. + seal "awskms" { + region = "eu-west-3" + kms_key_id = "367e11de-75f4-4df0-a038-b6cf06ae2ead" + } destination: server: https://kubernetes.default.svc