feat: replace Infisical with OpenBao as OSS secrets backend#8

Open

nbrieussel wants to merge 16 commits into

mainfrom

feat/001-replace-infisical-oss-secrets

Commits on Jun 21, 2026

feat: replace Infisical with OpenBao as OSS secrets backend

authored and
Nicolas Brieussel
committed
fix(ci): use openbao .deb package for bao CLI install

authored and
Nicolas Brieussel
committed
fix(ci): bump BAO_VERSION to 2.5.5

authored and
Nicolas Brieussel
committed
fix(ci): use server-side apply for ArgoCD install

authored and
Nicolas Brieussel
committed
fix(ci): install argocd CLI before port-forward step

authored and
Nicolas Brieussel
committed
refactor(ci): replace ArgoCD e2e with direct helm smoke-test script

authored and
Nicolas Brieussel
committed
fix(ci): wait for ESO CRDs to propagate before installing openbao-init

authored and
Nicolas Brieussel
committed
fix: pivot to Raft storage, fix init Job curl/SSE bugs

authored and
Nicolas Brieussel
committed

Commits on Jun 27, 2026

refactor(ci): drop smoke-test job — ArgoCD handles deploy

authored and
Nicolas Brieussel
committed
docs: add OpenBao health check to doctor commands

authored and
Nicolas Brieussel
committed
docs: add local dev workflow + gitops_revision gotcha to README

authored and
Nicolas Brieussel
committed
fix: skip dry-run on ClusterSecretStore when ESO CRD not yet ready

authored and
Nicolas Brieussel
committed
fix: server-side apply for ESO to bypass 256KB CRD annotation limit

authored and
Nicolas Brieussel
committed
fix: break init chicken-and-egg with sync-wave ordering

authored and
Nicolas Brieussel
committed
fix: keep init Job pods alive 1h after completion for log access

authored and
Nicolas Brieussel
committed
fix: add --sse AES256 to S3 puts — bucket enforces server-side encryption

authored and
Nicolas Brieussel
committed