Skip to content

Generate Openbao Ruby client through Open API

Erick Bajao requested to merge eb-add-openbao-ruby-client into master

This adds the OpenbaoClient gem that is generated from the OpenBao OpenAPI spec. We need this to start work on #469580.

How was this ruby client generated

  1. Clone https://github.com/openbao/openbao locally.
  2. Make sure bao is in $PATH.
  3. Run scripts/gen_openapi.sh.
    • This would generate scripts/openapi.json.
  4. Install openapi-generator (homebrew) from https://openapi-generator.tech.
  5. Generate the ruby client: 
    openapi-generator generate -g ruby -i scripts/openapi.json -o ~/gitlab-development-kit/gitlab/gems/openbao_client --additional-properties=gemName=openbao_client

Sample usage

Make sure OpenBao proxy is running, for example at http://127.0.0.1:8100. Sample configuration can be found in #470143 (comment 1984247205).

OpenbaoClient.configure { |c| c.host = 'http://127.0.0.1:8100'; c.base_path = 'v1' }

system_api = OpenbaoClient::SystemApi.new

system_api.mounts_enable_secrets_engine('projects/56/ci', OpenbaoClient::MountsEnableSecretsEngineRequest.new(type: 'kv-v2'))

This will enable the secret engine at the given path.

Notes

  • Due to https://github.com/openbao/openbao/issues/407, I had to manually edit the logical_system_paths.go file locally for now, and recompiled (i.e. make) a bao binary and replaced the one I have in $PATH.
  • For now, we will have this ruby client under our gems directory as per guidelines. But eventually, this might be moved under the openbao namespace as a 3rd party gem. This is also why I skipped the gem validation in the CI config, or else it would require us to reserve the gem name under the RubyGems GitLab account.
  • Given this ruby client is generated by OpenAPI generator, we are not using the GitLab rubocop config, but rather we are using the OpenAPI generated one.
Edited by Erick Bajao

Merge request reports