Enabling OpenBao (Development Only)

This guide is meant to target developers who want to enable the OpenBao integration with GitLab.

Prerequisites

  • GitLab Ultimate (developer) license.
  • A Kubernetes cluster with a public IP.
  • A cert-manager installation (can be the cert-manager bundled with this chart).

Setup GitLab and OpenBao

  1. Install/upgrade GitLab with your a developer license and enable OpenBao:

    # Enable OpenBao integration
global:
  openbao:
    enabled: true
# Install bundled OpenBao
openbao:
  install: true

  2. Initialise OpenBao. Make sure to pass the correct namespace, release and external GitLab and OpenBao URLs.

    export NAMESPACE=gitlab
export RELEASE=gitlab
curl -s "https://gitlab.com/gitlab-org/cloud-native/charts/openbao/-/blob/main/scripts/dev/init-bao.sh" \
  | bash -s -- https://gitlab.example.com https://openbao.example.com

    First, the script initialises OpenBao and stores the unseal and root keys as Kubernetes secrets. Then, it sets up the authentication policies and revokes the original root token.

  3. Enable the necessary feature flags in a rails console:

    Feature.enable(:secrets_manager)
Feature.enable(:ci_tanukey_ui)

  4. In GitLab, on the left sidebar, select Search or go to and find your project.

  5. Select Settings > General.

  6. Expand Visibility, project features, permissions.

  7. Turn on the Secrets Manager toggle, and wait for the Secrets Manager to be provisioned.

Configuration

Configuring the database

By default, OpenBao connects to the main rails database with the same credentials and configuration.

If you want to use another database, you can override these settings:

openbao:
  config:
    storage:
      postgresql:
        connection:
          host: "psql.openbao.example.com"
          port: 5432
          database: openbao
          username: openbao
          connectTimeout:
          keepalives:
          keepalivesIdle:
          keepalivesInterval:
          keepalivesCount:
          tcpUserTimeout:
          sslMode: "disable"
          password: {}
          # secret:
          # key:

Limitations

Current known limitations:

  1. OpenBao updates imply downtime.
  2. Certmanager must be installed before OpenBao, so Helm can locale the Certificate CRD.