Deploy the OpenBao Agent Injector to automatically inject secrets into pod containers via init and sidecar containers.
Prerequisites checklist
Confirm these before running steps:
- OpenBao deployed and unsealed with secrets and Kubernetes auth
- OpenBao Agent Injector deployed (part of the initial Helm chart deployment)
- Kubernetes auth role configured for target service accounts
1Verify the OpenBao Agent Injector is running
The injector should be already installed using the initial helm chart deployment. This was done as part of TC-OPENBAO-OCP-001.
Injector was enabled with a replica of 2
oc get pods -l app.kubernetes.io/name=openbao-agent-injector -n openbao2Create a policy and role for the application
bao write auth/kubernetes/role/myapp bound_service_account_names=myapp-sa bound_service_account_namespaces=myapp policies=myapp ttl=1h3Copy OpenBao CA into the app namespace
Since we are using TLS we need to trust the certificate
oc create secret generic openbao-ca -n myapp \
--from-literal=ca.crt="$(oc get secret openbao-ca-secret -n openbao -o jsonpath='{.data.ca\.crt}' | base64 -d)" \
--dry-run=client -o yaml | oc apply -f -4Deploy a pod with OpenBao Agent annotations
Apply from the Commands / YAML tab
5Verify the init and sidecar containers are injected
oc get pods -n myapp -o jsonpath='{.items[0].spec.containers[*].name}'oc get pods -n myapp -o jsonpath='{.items[0].spec.initContainers[*].name}'6Verify secrets are rendered in the pod
Get the pods name
oc get pods -n myappoc exec -it <pod-name> -c app -n myapp -- cat /vault/secrets/config.txtSuccess:
config.txt contains the secret7Clean up
oc delete deployment myapp -n myapp