Add a lab MariaDB instance to namespace db-tests (created during TC-OPENBAO-DB-001), configure a second database connection on the same secrets engine, and verify dynamic MySQL credentials.
Prerequisites checklist
Confirm these before running steps:
- TC-OPENBAO-OCP-001Enable TLS end-to-end on OpenBao (OpenShift)
- TC-OPENBAO-DB-001Dynamic PostgreSQL Credentials
- Cluster can pull
mariadb:11(or adjust image in the Commands / YAML tab)
1Deploy lab MariaDB in namespace db-tests (full manifest in the Commands / YAML tab):
→ This will use an existing Namespace db-tests, and create a new Secret for credentials, ConfigMap for initial configuration, a Service and a Deployment.
2Wait for the deployment to be available
oc wait --for=condition=Available deployment/mysql -n db-tests --timeout=180s→ Deployment Available
3Configure the MySQL connection (second config on the same database/ mount)
bao write database/config/mysql plugin_name=mysql-database-plugin allowed_roles=mysql-readonly,mysql-readwrite connection_url='{{username}}:{{password}}@tcp(mysql.db-tests.svc.cluster.local:3306)/mydb' username=bao_admin password=adminP@ss→ Success! Data written to: database/config/mysql
4Create a readonly role with MySQL grant statements
bao write database/roles/mysql-readonly db_name=mysql creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; GRANT SELECT ON mydb.* TO '{{name}}'@'%';" revocation_statements="REVOKE ALL PRIVILEGES, GRANT OPTION FROM '{{name}}'@'%'; DROP USER IF EXISTS '{{name}}'@'%';" default_ttl=1h max_ttl=24h→ Success! Data written to: database/roles/mysql-readonly
5Create a readwrite role
bao write database/roles/mysql-readwrite db_name=mysql creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; GRANT SELECT, INSERT, UPDATE, DELETE ON mydb.* TO '{{name}}'@'%';" default_ttl=4h max_ttl=24h→ Success! Data written to: database/roles/mysql-readwrite
6Request dynamic credentials
bao read database/creds/mysql-readonly→ Returns unique
username and password7Test the dynamic credentials via oc exec into the MariaDB pod (see the Commands / YAML tab):
→
SELECT current_user shows the dynamic role; SELECT * FROM demo succeeds→
INSERT INTO demo ... fails with permission denied for readonly creds8Rotate the root credentials stored in OpenBao
bao write -f database/rotate-root/mysql→ Root password rotated in MariaDB and updated in OpenBao config
9Cleanup lab namespace
oc delete namespace db-tests --wait=true→ Namespace
db-tests removed (PostgreSQL from DB-001 and MariaDB from this testcase)