Openbao service registration labels/support

[s1111m]

Preflight Checklist

• I have searched the issue tracker for an issue that matches the one I want to file, without success.
• I agree to follow the Code of Conduct.

Problem Description

From openbao 2.2.0 , serviceregistration label's it service with label openbao-active: true.

Operator adds hardcoded selector to service

vault-operator/pkg/controller/vault/vault_controller.go

Line 615 in f3fd82a

selectorLs["vault-active"] = "true"

And service cannot select active instance of openbao.

Proposed Solution

As possible solution you can add serviceRegistrationName variable and make selector as "$serviceRegistrationName-active": true

Alternatives Considered

No response

Additional Information

No response

[github-actions]

Thank you for your contribution! This issue has been automatically marked as stale because it has no recent activity in the last 60 days. It will be closed in 20 days, if no further activity occurs. If this issue is still relevant, please leave a comment to let us know, and the stale label will be automatically removed.

[paul-prdca]

This would be very helpful. I may be able to make time to put a PR together for this.

(but also just trying to keep the issue bot from aging it out)

[rosieks]

I made already similar PR #798 to write configuration in different location. I could make it too. I just wonder if it make sense to add more and more parameters or maybe there should be just one property indicating what implementation is behind

[snuxoll]

While OpenBao currently maintains compatibility with the API of HashiCorp vault as of the time the fork began, there's no explicit guarantee that will always continue to be the case, or that there may not be additional features added to OpenBao that bank-vaults may wish to use that will not (cannot, as long as hashicorp continues to use the BSL) be in Hashicorp Vault.

Regardless, I think given there is likely to be the odd compatibility issue, it might make sense to just add a field to the VaultSpec that lets users specify whether they're using vault or openbao and use the appropriate defaults for the time being.

Personally, given Bank-Vaults status as a CNCF project and OpenBao being under the OpenSSF, both of which are Linux Foundation subsidiaries, I'd love to see the projects start to collaborate a bit more closely and be the default pairing.

[github-actions]

Thank you for your contribution! This issue has been automatically marked as stale because it has no recent activity in the last 60 days. It will be closed in 20 days, if no further activity occurs. If this issue is still relevant, please leave a comment to let us know, and the stale label will be automatically removed.

[srekkas]

Tried migrate vault 1.4.10 with raft HA storage to openbao 2.4.0 image. It works, but service not, because of this label :(
Workaround to set on CR

vaultLabels:
    vault-active : "true" 

[bergethon]

Tried migrate vault 1.4.10 with raft HA storage to openbao 2.4.0 image. It works, but service not, because of this label :( Workaround to set on CR

vaultLabels:
    vault-active : "true" 

This will make the standby nodes also have the label, and be selected by the service. (Which should only point to the active node), so it still could cause some issues.

[srekkas]

Tried migrate vault 1.4.10 with raft HA storage to openbao 2.4.0 image. It works, but service not, because of this label :( Workaround to set on CR

vaultLabels:
    vault-active : "true" 

This will make the standby nodes also have the label, and be selected by the service. (Which should only point to the active node), so it still could cause some issues.

Thanks, yes, it pointed to all pods, so made separate service, who points to "openbao-active: true"

[bbplatforma]

As service and certificate DNS names is hardcoded, there is problem when you need to access local vault service, with workaround, service points to all pods, not just active pods.

Maybe it was option do disable service creation or choose label selector

[srekkas]

Openbao recent version 2.5.0 introduce read from all members and write forwarding, maybe it will work now? :)

https://github.com/openbao/openbao/releases/tag/v2.5.0