# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# OpenBao values for standalone installation
# Replace <REGISTRY>, <REPOSITORY>, and secret values with your settings.
#
# Example:
#   REGISTRY: nvcr.io
#   REPOSITORY: YOUR_ORG/YOUR_TEAM

openbao:
  migrations:
    image:
      registry: "<REGISTRY>"
      repository: "<REPOSITORY>/nvcf-openbao-migrations"
    issuerDiscovery:
      enabled: true  # Recommended true for EKS (discovers OIDC issuer automatically)
    env:
      - name: DEFAULT_CASSANDRA_PASSWORD
        value: "ch@ng3m3"  # Must match Cassandra superuser password
      - name: NVCF_API_SIDECARS_IMAGE_PULL_SECRET
        value: "<REGISTRY_CREDENTIAL_B64>"  # base64 of $oauthtoken:<NGC_API_KEY>
      - name: ADMIN_CLIENT_ID
        value: ncp  # Do not change

  injector:
    image:
      registry: "<REGISTRY>"
      repository: "<REPOSITORY>/oss-vault-k8s"
    agentImage:
      registry: "<REGISTRY>"
      repository: "<REPOSITORY>/nvcf-openbao"
    replicas: 2
    podDisruptionBudget:
      minAvailable: 1
    # Uncomment for node selectors
    # nodeSelector:
    #   nvcf.nvidia.com/workload: vault

  server:
    image:
      registry: "<REGISTRY>"
      repository: "<REPOSITORY>/nvcf-openbao"
    dataStorage:
      size: "10Gi"  # 20-50Gi recommended for production
      # storageClass: "<STORAGE_CLASS>"
    # Uncomment for node selectors
    # nodeSelector:
    #   nvcf.nvidia.com/workload: vault
    extraContainers:
      - name: auto-unseal-sidecar
        image: "<REGISTRY>/<REPOSITORY>/nvcf-openbao:2.5.1-nv-1.1.0"
        volumeMounts:
          - name: openbao-server-unseal
            mountPath: /vault/userconfig/unseal
            readOnly: true
        command: ["/bin/sh", "-c"]
        args:
          - |
            echo "Starting auto-unseal monitor..."
            export BAO_ADDR=http://$HOSTNAME:8200
            while true; do
              if [ -f /vault/userconfig/unseal/unseal_key ]; then
                UNSEAL_KEY=$(cat /vault/userconfig/unseal/unseal_key)
                if [ ! -z "$UNSEAL_KEY" ]; then
                    bao operator unseal $UNSEAL_KEY
                    sleep 60
                    continue
                else
                  echo "Unseal key is empty, waiting..."
                fi
              else
                echo "Unseal key file not found, waiting..."
              fi
              sleep 10
            done