OpenBao chart

You can use the OpenBao chart to install OpenBao, which is required to enable the GitLab secrets manager.

Known issues

• You can’t upgrade OpenBao without downtime. Zero downtime upgrades are proposed in OpenBao chart issue 13.
• GitLab Geo is unsupported. Basic validation passed, but failover and recommended setups are not tested and documented yet. Full validation is discussed in GitLab issue 568357.
• You can’t deploy OpenBao with GitLab Operator.
• A FIPS variant of the OpenBao image is already being build, but OpenBao is not FIPS validated. FIPS validation is tracked in GitLab issue 574875.
• The OpenBao chart and streaming of OpenBao auditing events to GitLab cannot be enabled at the same time. For more information, see issue 582828.

Setup GitLab secret manager and OpenBao

1. On an existing GitLab instance, enable OpenBao:

   # Enable OpenBao integration
   global:
     openbao:
       enabled: true
   # Install bundled OpenBao
   openbao:
     install: true

2. In GitLab, on the top bar, select Search or go to and find your project.

3. Select Settings > General.

4. Expand Visibility, project features, permissions.

5. Turn on the Secrets Manager toggle, and wait for the Secrets Manager to be provisioned.

Rolling back OpenBao upgrades

OpenBao upgrades can make changes to the PostgreSQL data that are not backwards compatible, which can cause compatibility issues if the OpenBao upgrade must be rolled back.

You should always back up before upgrading OpenBao. If you need to roll back an OpenBao upgrade, also restore the database backup matching the OpenBao version.

For more information, see OpenBao upgrade documentation.

Back up OpenBao

To completely back up OpenBao, you require:

• Unseal keys. These keys are essential for accessing your OpenBao data after restoration. Follow the secret backup procedures for OpenBao secrets.
• The PostgreSQL database.

By default, the OpenBao PostgreSQL data is backed up as part of the chart’s built-in backup procedure.

If you’ve configured OpenBao to use a different database (logical or physical), this database must be backed up manually. The default backup tooling only covers the standard PostgreSQL setup because the tooling has no awareness of other external databases. To avoid any synchronisation issues, the GitLab and OpenBao database should be backed up at the same time.

Restore OpenBao

By default, the OpenBao PostgreSQL data is restored as part of the chart’s built-in restore procedure.

If you’ve configured OpenBao to use a different database (logical or physical), the OpenBao database backup cannot be restored by the built-in backup utility, and must be restored manually.

Before restoring a OpenBao backup, make sure OpenBao is scaled down because it will try to recreate its database schema, which can lead to unexpected errors. To scale down OpenBao, run:

kubectl scale deploy -lapp=openbao,release=<helm release name> -n <namespace> --replicas=0

OpenBao configuration options

The following tables list all available OpenBao configuration options.

Installation command-line options

The table below contains all the possible charts configurations that can be supplied to the helm install command using the --set flags.

Container image options

The OpenBao chart deploys a cloud-native GitLab container image to deploy OpenBao. The OpenBao build includes modifications from the upstream version. As a result, some functionality may differ from the standard OpenBao releases.

Ingress and TLS configuration options

The OpenBao chart defaults to Ingress-terminated TLS encryption.

You should operate OpenBao with end-to-end encrypted TLS. To enable end-to-end TLS configure, OpenBao to expect a TLS connection and pass the TLS connection through NGINX Ingress:

global:
  ingress:
    useNewIngressForCerts: true
config:
  tlsDisable: false
ingress:
  sslPassthroughNginx: true

Note: Enabling SSL passthrough requires cert-manager to create another Ingress to complete HTTP01 challanges. If you use the bundled certmanager and Issuer, make sure the Issuer sets the correct IngressClass by configuring global.ingress.useNewIngressForCerts.

Gateway API

The OpenBao chart allows to expose traffic via an HTTPRoute. If Gateway API is enabled globally, a listener for OpenBao will be created in the managed Gateway resource.

Monitoring configuration options

OpenBao is preconfigured to expose Prometheus metrics which will be scraped by the bundled Prometheus subchart.

Unsealing and initialization options

The OpenBao chart makes use of static auto unsealing and OpenBao declarative self initialization.

Audit event streaming options

The OpenBao chart configures auditing devices to stream events to GitLab.

Configure an external database

By default, OpenBao connects to the main GitLab database with the same credentials and configuration.

To configure an external database:

1. Create a PostgreSQL user and database on your database server:

   -- Create the OpenBao user
   CREATE USER openbao WITH PASSWORD '<password>';
   
   -- Create the OpenBao database
   CREATE DATABASE openbao OWNER openbao;

2. Create a Kubernetes secret containing the password:

   kubectl create secret -n bao generic openbao-db-password --from-literal=password="<password>"

3. Configure OpenBao to connect to your external database:

   openbao:
     config:
       storage:
         postgresql:
           connection:
             host: "psql.openbao.example.com"
             port: 5432
             database: openbao
             username: openbao
             # connectTimeout:
             # keepalives:
             # keepalivesIdle:
             # keepalivesInterval:
             # keepalivesCount:
             # tcpUserTimeout:
             # sslMode: "disable"
             password:
               secret: openbao-db-passowrd
               key: password

4. Deploy or upgrade OpenBao. When starting, OpenBao automatically creates its database schema in the specified database.