Initial GitLab Secret Manager (OpenBao) support

What does this MR do?

The MR adds Experimental initial GitLab Secret Manager (OpenBao) support

  • Cloud Native Hybrid support only with Chart (no Operator)
  • Only for external DB installations (cloud provider DBs, not Omnibus PG cluster)
  • Deployed on Supporting node pool
  • OpenBao DB is created as separate logical DB on main PG
  • Limited Geo support aligning with GitLab Secret Manager feature Geo support status

Relevant docs: https://gitlab.com/gitlab-org/cloud-native/charts/openbao, https://docs.gitlab.com/charts/charts/openbao/

Feature additions:

  • Required configurations from user are OpenBao URL, db password for OpenBao DB, and Chart specific deployment configs - replicas, CPU and memory limits
  • TLS is enabled if URL contains https
  • Optional support for Unseal keys secret allowing users to provide values for secret - required for Geo installation to sync the key between sites
  • Monitoring is enabled with PodMonitor setting
  • The MR also adds OpenBao molecule scenario for local testing

https://gitlab.com/gitlab-org/gitlab-environment-toolkit/-/work_items/1138+

Author's checklist

When ready for review, the Author applies the workflowready for review label and mention @gitlab-org/software-delivery/get-maintainers:

  • Merge request:
    • Corresponding Issue raised and reviewed by the GET maintainers team.
    • Merge Request Title and Description are up-to-date, accurate, and descriptive
    • MR targeting the appropriate branch
    • MR has a green pipeline
    • MR has no new security alerts in the widget from the Secret Detection and IaC Scan (SAST) jobs.
  • Code:

Closes #1138

Edited by Nailia Iskhakova

Merge request reports

Loading