From a66cfc31ffb13512084a4a389e899dad9e232c7a Mon Sep 17 00:00:00 2001 From: redhat-chai-bot Date: Wed, 2 Sep 2026 05:55:41 +0000 Subject: [PATCH 1/2] OSAC-4704: Enable OpenBao by default Enable bundled OpenBao (bundledVault) throughout osac-installer so every CI and dev environment gets a Vault-compatible secret store without per-profile opt-in. P0: Remove bundledVault blocks from CI infra.yaml files (caas-ci, vmaas-ci, bmaas-ci, full-ci) -- these were misplaced because the bundled-openbao.yaml template belongs to the Phase 3 osac chart, but infra.yaml is only passed to osac-deps and osac-infra charts. P1: Flip defaults in charts/osac/values.yaml (enabled: true, devRootToken: "dev-root-token") and update values.schema.json to match. P2: Update helm-deployment-guide.md CI/Dev features table to reflect the new default, and add bundled-openbao to AGENTS.md Phase 3 template listing. P3: Retained bundledVault in dev/kind-instance.yaml for self-documentation (matches the pattern of other explicit overrides in that file). Assisted-by: Claude Signed-off-by: redhat-chai-bot --- osac-installer/AGENTS.md | 2 +- osac-installer/charts/osac/values.schema.json | 5 +++-- osac-installer/charts/osac/values.yaml | 4 ++-- osac-installer/docs/helm-deployment-guide.md | 12 ++++++------ osac-installer/values/bmaas-ci/infra.yaml | 7 ------- osac-installer/values/caas-ci/infra.yaml | 7 ------- osac-installer/values/full-ci/infra.yaml | 7 ------- osac-installer/values/vmaas-ci/infra.yaml | 7 ------- 8 files changed, 12 insertions(+), 39 deletions(-) diff --git a/osac-installer/AGENTS.md b/osac-installer/AGENTS.md index 9b2784d954..72d80c0af9 100644 --- a/osac-installer/AGENTS.md +++ b/osac-installer/AGENTS.md @@ -118,7 +118,7 @@ Phase 3: charts/osac/ # OSAC platform (per-instance workload) osac-ui (conditional: ui.enabled) -- a real external chart, via an oci:// reference pinned to a released version in Chart.yaml - Templates: hub-access, hooks (create-hub, pre-install-validate, + Templates: hub-access, bundled-openbao, hooks (create-hub, pre-install-validate, publish-templates, seed-cluster-versions, register-local-storage) values.schema.json validates all configuration ``` diff --git a/osac-installer/charts/osac/values.schema.json b/osac-installer/charts/osac/values.schema.json index bebc4d5d2c..2e4580f926 100644 --- a/osac-installer/charts/osac/values.schema.json +++ b/osac-installer/charts/osac/values.schema.json @@ -1486,11 +1486,12 @@ "enabled": { "type": "boolean", "description": "Deploy a bundled OpenBao instance for development/CI use", - "default": false + "default": true }, "devRootToken": { "type": "string", - "description": "Root token for OpenBao dev mode (required when enabled)" + "description": "Root token for OpenBao dev mode (required when enabled)", + "default": "dev-root-token" }, "image": { "type": "string", diff --git a/osac-installer/charts/osac/values.yaml b/osac-installer/charts/osac/values.yaml index 46b9f9de89..bc73b83981 100644 --- a/osac-installer/charts/osac/values.yaml +++ b/osac-installer/charts/osac/values.yaml @@ -329,8 +329,8 @@ hubAccess: enabled: false bundledVault: - enabled: false - devRootToken: "" + enabled: true + devRootToken: "dev-root-token" image: "ghcr.io/openbao/openbao:2.6.2" resources: limits: diff --git a/osac-installer/docs/helm-deployment-guide.md b/osac-installer/docs/helm-deployment-guide.md index 1acb54cffc..c0772f7521 100644 --- a/osac-installer/docs/helm-deployment-guide.md +++ b/osac-installer/docs/helm-deployment-guide.md @@ -109,13 +109,13 @@ Key settings: ## CI/Dev-Only Features -These are top-level values, disabled by default. Enable only in CI/dev: +These are top-level values for CI/dev use. Disable in production: -| Value | What it does | -|-------|-------------| -| `hubAccess.enabled` | Creates hub-access SA/RBAC and registers local cluster as a hub. Only for environments where fulfillment-service and hub are the same cluster. | -| `bundledPostgres.enabled` | Deploys a single-pod ephemeral PostgreSQL. Uses `fsync=off` and `emptyDir` — data lost on restart. Not for production. | -| `bundledVault.enabled` | Deploys a single-pod ephemeral OpenBao (Vault-compatible) secret store for testing. Dev mode — data is lost on restart. Not for production. | +| Value | Default | What it does | +|-------|---------|-------------| +| `hubAccess.enabled` | `false` | Creates hub-access SA/RBAC and registers local cluster as a hub. Only for environments where fulfillment-service and hub are the same cluster. | +| `bundledPostgres.enabled` | `false` | Deploys a single-pod ephemeral PostgreSQL. Uses `fsync=off` and `emptyDir` — data lost on restart. Not for production. | +| `bundledVault.enabled` | `true` | Deploys a single-pod ephemeral OpenBao (Vault-compatible) secret store for testing. Dev mode — data is lost on restart. Not for production. | ## Infrastructure Configuration diff --git a/osac-installer/values/bmaas-ci/infra.yaml b/osac-installer/values/bmaas-ci/infra.yaml index b8cf0299d1..3fefb8fbd1 100644 --- a/osac-installer/values/bmaas-ci/infra.yaml +++ b/osac-installer/values/bmaas-ci/infra.yaml @@ -34,10 +34,3 @@ bundledPostgres: database: name: service user: service - -# --- Bundled OpenBao --- -# Single-pod ephemeral Vault-compatible secret store for testing. Dev mode -- -# data is lost on restart. Not for production. -bundledVault: - enabled: true - devRootToken: "dev-root-token" diff --git a/osac-installer/values/caas-ci/infra.yaml b/osac-installer/values/caas-ci/infra.yaml index f5fcb02f02..56f41d6496 100644 --- a/osac-installer/values/caas-ci/infra.yaml +++ b/osac-installer/values/caas-ci/infra.yaml @@ -40,10 +40,3 @@ bundledPostgres: enabled: true database: name: service - -# --- Bundled OpenBao --- -# Single-pod ephemeral Vault-compatible secret store for testing. Dev mode -- -# data is lost on restart. Not for production. -bundledVault: - enabled: true - devRootToken: "dev-root-token" diff --git a/osac-installer/values/full-ci/infra.yaml b/osac-installer/values/full-ci/infra.yaml index 37a20fb74f..73568f0a67 100644 --- a/osac-installer/values/full-ci/infra.yaml +++ b/osac-installer/values/full-ci/infra.yaml @@ -37,10 +37,3 @@ bundledPostgres: database: name: service user: service - -# --- Bundled OpenBao --- -# Single-pod ephemeral Vault-compatible secret store for testing. Dev mode -- -# data is lost on restart. Not for production. -bundledVault: - enabled: true - devRootToken: "dev-root-token" diff --git a/osac-installer/values/vmaas-ci/infra.yaml b/osac-installer/values/vmaas-ci/infra.yaml index c6c8c25256..158ab04193 100644 --- a/osac-installer/values/vmaas-ci/infra.yaml +++ b/osac-installer/values/vmaas-ci/infra.yaml @@ -36,10 +36,3 @@ bundledPostgres: database: name: service user: service - -# --- Bundled OpenBao --- -# Single-pod ephemeral Vault-compatible secret store for testing. Dev mode -- -# data is lost on restart. Not for production. -bundledVault: - enabled: true - devRootToken: "dev-root-token" From b845a63e6215d3c0396e30b6ff65ccd55e88d895 Mon Sep 17 00:00:00 2001 From: redhat-chai-bot Date: Wed, 2 Sep 2026 06:28:28 +0000 Subject: [PATCH 2/2] OSAC-4704: Fix AGENTS.md conditional qualifier and remove redundant dev override Add (conditional: bundledVault.enabled) to the bundled-openbao entry in AGENTS.md Phase 3 template listing, matching the pattern used by other conditional templates. Remove the now-redundant bundledVault block from dev/kind-instance.yaml since the values.yaml defaults now match exactly. Assisted-by: Claude Signed-off-by: redhat-chai-bot --- osac-installer/AGENTS.md | 2 +- osac-installer/values/dev/kind-instance.yaml | 5 ----- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/osac-installer/AGENTS.md b/osac-installer/AGENTS.md index 72d80c0af9..b8dc430291 100644 --- a/osac-installer/AGENTS.md +++ b/osac-installer/AGENTS.md @@ -118,7 +118,7 @@ Phase 3: charts/osac/ # OSAC platform (per-instance workload) osac-ui (conditional: ui.enabled) -- a real external chart, via an oci:// reference pinned to a released version in Chart.yaml - Templates: hub-access, bundled-openbao, hooks (create-hub, pre-install-validate, + Templates: hub-access, bundled-openbao (conditional: bundledVault.enabled), hooks (create-hub, pre-install-validate, publish-templates, seed-cluster-versions, register-local-storage) values.schema.json validates all configuration ``` diff --git a/osac-installer/values/dev/kind-instance.yaml b/osac-installer/values/dev/kind-instance.yaml index fa758c5897..77bbb4cf0a 100644 --- a/osac-installer/values/dev/kind-instance.yaml +++ b/osac-installer/values/dev/kind-instance.yaml @@ -167,8 +167,3 @@ capiProvider: kafka: enabled: true replicas: 1 - -# --- Vault compatible secret store (OpenBao) --- -bundledVault: - enabled: true - devRootToken: "dev-root-token"