Skip to content
Homelab

OpenBao and CSI Driver

Phase 5. Risk: medium, every app reads its secrets through this layer. Pins in config/versions.yaml: charts.openbao, images.openbao (server, CSI agent and unseal sidecar), charts.secrets-store-csi-driver.

config/versions.yaml
charts:
  openbao: {repo: https://openbao.github.io/openbao-helm, version: 0.X.Y}
  secrets-store-csi-driver: {repo: https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts, version: 1.X.Y}
images:
  openbao: {image: openbao/openbao, tag: 2.X.Y}

The image is pinned, not the chart appVersion: OpenBao 2.7 removes the file storage backend this cluster uses, so the image stays on 2.6.x while the chart moves. Check chart/image compatibility against the OpenBao tags.

Terminal window
just synth && git push
kubectl logs -n openbao openbao-0 -c unseal
kubectl exec -n openbao openbao-0 -c openbao -- bao status        # Sealed: false
kubectl exec -n harbor deploy/secret-sync -- ls /mnt/secrets/      # CSI mount still populated