Skip to content

Latest commit

 

History

History
123 lines (94 loc) · 9.87 KB

README.md

File metadata and controls

123 lines (94 loc) · 9.87 KB

OpenBao Cluster

Deploy a OpenBao instance following HashiCorp's best practices. Complete these steps in order:

  1. Server Certificates: Prepare certificates first. You can provide yours or use the guide: Public Key Infrastructure (PKI): Requirements.

  2. OpenBao Instance Setup: Start your OpenBao instance. See Getting Started for instructions.

  3. Configure OpenBao: After setting up the cluster, configure it. Switch to the management directory for PKI, roles, etc.

💪 High availability

⚠️ You can choose between two modes when creating a OpenBao instance: dev and ha (default: dev). Here are the differences between these modes:

Dev HA
Number of nodes 1 5
Disk type hdd ssd
OpenBao storage type file raft
Instance type(s) t3.micro mixed (lower-price)
Capacity type on-demand spot

In designing a production environment for HashiCorp OpenBao, I opted for a balance between performance and reliability. Key architectural decisions include:

  1. Raft Protocol for Cluster Reliability: Utilizing the Raft protocol, recognized for its robustness in distributed systems, to ensure cluster reliability in a production environment.

  2. Five-Node Cluster Configuration: Following best practices for fault tolerance and availability, this setup significantly reduces the risk of service disruption and is a recommended choice when using the Raft protocol.

  3. Ephemeral Node Strategy with SPOT Instances: This approach provides operational flexibility and cost efficiency. Note that we also use multiple instance pools. When a Spot Instance in AWS Auto Scaling is interrupted, the system automatically replaces it with another available instance from a different Spot Instance pool, ensuring continuous operation while optimizing costs.

  4. Data Storage on RAID0 Array: Prioritizing performance, RAID0 arrays offer faster data access. The Raft protocol and a robust backup/restore strategy help mitigate the lack of redundancy in RAID0.

  5. OpenBao Auto-Unseal Feature: Configured to accommodate the ephemeral nature of nodes, ensuring minimal downtime and manual intervention.

This architecture balances performance, cost-efficiency, and resilience, embracing the dynamic nature of cloud resources for operational flexibility.

🔒 Security Considerations

  • Keep the Root CA offline.
  • Use hardened AMIs, such as those built with this project from @konstruktoid. An Ubuntu AMI from Canonical is used by default.
  • Disable SSM once the cluster is operational and an Identity provider is configured.
  • Implement MFA for authentication.

Requirements

Name Version
terraform ~> 1.4
aws ~> 5.0
cloudinit ~> 2.3

Providers

Name Version
aws ~> 5.0
cloudinit ~> 2.3

Modules

Name Source Version
openbao_asg terraform-aws-modules/autoscaling/aws ~> 8.0

Resources

Name Type
aws_iam_instance_profile.this resource
aws_iam_role.this resource
aws_iam_role_policy.openbao-kms-unseal resource
aws_iam_role_policy_attachment.ec2_read_only resource
aws_iam_role_policy_attachment.ssm resource
aws_kms_key.openbao resource
aws_launch_template.dev resource
aws_launch_template.ha resource
aws_lb.this resource
aws_lb_listener.this resource
aws_lb_target_group.this resource
aws_route53_record.nlb resource
aws_security_group.nlb resource
aws_security_group.openbao resource
aws_security_group_rule.allow_8200 resource
aws_security_group_rule.openbao_internal_api resource
aws_security_group_rule.openbao_internal_raft resource
aws_security_group_rule.openbao_network_ingress resource
aws_security_group_rule.openbao_node_exporter resource
aws_security_group_rule.openbao_outbound resource
aws_ami.this data source
aws_ecr_authorization_token.token data source
aws_iam_policy_document.openbao-kms-unseal data source
aws_route53_zone.this data source
aws_security_group.tailscale data source
aws_subnets.private data source
aws_vpc.selected data source
cloudinit_config.openbao_cloud_init data source

Inputs

Name Description Type Default Required
ami_filter List of maps used to create the AMI filter for the action runner AMI. map(list(string)) 
{
  "name": [
    "ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"
  ]
}
 no
ami_owner Owner ID of the AMI string "099720109477" no
domain_name The domain name for which the certificate should be issued string n/a yes
enable_ssm If true, allow to connect to the instances using AWS Systems Manager bool false no
env The environment of the OpenBao cluster string n/a yes
leader_tls_servername One of the shared DNS SAN used to create the certs use for mTLS string n/a yes
mode OpenBao cluster mode (default dev, meaning a single node) string "dev" no
name Name of the resources created for this OpenBao cluster string "openbao" no
openbao_data_path Directory where OpenBao's data will be stored in an EC2 instance string "/opt/openbao/data" no
openbao_version OpenBao version to install string "2.1.0" no
prometheus_node_exporter_enabled If set to true install and start a prometheus node exporter bool false no
region AWS Region string "eu-west-3" no
tags A map of tags to add to all resources map(string) {} no

Outputs

Name Description
autoscaling_group_id n/a