Skip to content

Add OpenBao and mc-terrarium integration#2351

Merged
cb-github-robot merged 3 commits intocloud-barista:mainfrom
yunkon-kim:260309-17
Mar 9, 2026
Merged

Add OpenBao and mc-terrarium integration#2351
cb-github-robot merged 3 commits intocloud-barista:mainfrom
yunkon-kim:260309-17

Conversation

@yunkon-kim
Copy link
Copy Markdown
Member

@yunkon-kim yunkon-kim commented Mar 9, 2026 •
edited
Loading

This PR integrates mc-terrarium v0.1.0 and OpenBao.
It involves broad internal changes, but the usage remains mostly the same except for the new .env setup.

What's changed

  • Add OpenBao service for centralized CSP credential management
  • Integrate mc-terrarium v0.1.0 for infrastructure enrichment (VPN)
  • Add auto-init/unseal logic for OpenBao in Makefile
  • Register CSP credentials to OpenBao via init.py
  • Remove .env from tracking, add .env.example template
  • Update docker-compose.yaml with mc-terrarium and OpenBao services
  • Simplify API auth to plaintext for dev (remove bcrypt)
  • New ports:
Service Port
MC-Terrarium :8055
OpenBao :8200

Maintainer & Contributor To-Dos 😉

.env is no longer tracked by Git. Please configure your .env before running make compose or make up:

cp .env.example .env
# Edit .env to set API credentials (TB, Spider, Terrarium)
# VAULT_TOKEN will be auto-initialized by make compose on first run

Warning

Notes for maintainers and contributors

  • secrets/openbao-init.json: Generated on first make compose. Stores unseal key/root token. Keep it safe; data is inaccessible if lost. (Git-ignored).
  • make clean-all: Now also wipes OpenBao data, secrets, and .env VAULT_TOKEN. Run make compose && make init to restore the environment.
  • conf/openbao-config.hcl: Tracked by Git (intentional exception to conf/* ignore).

✅ Tests passed as follows

Feel free to share your thoughts or report any issues 💬

  1. Clean and initialize
cp .env.example .env   # Set up .env (VAULT_TOKEN left empty — auto-set by make compose)
    ↓
make clean-all         # Stop services + delete DB + wipe OpenBao data and token
    ↓
make up                # Build images + initialize OpenBao (no VAULT_TOKEN → run init-openbao.sh) + unseal + start all services
    ↓
make init              # Decrypt credentials.yaml.enc → register to CB-Spider + register CSP credentials to OpenBao KV v2
  1. Create a testbed infra (by Terrarium)
Access Terrarium API UI   # http://localhost:8055/terrarium/api/index.html
    ↓
Create a terrarium        # trId: testbed01
    ↓
Create a testbed          # trId: testbed01
  1. Create an MCI (on Map UI)
Access MapUI                          # http://localhost:1324
    ↓
Click and select VM spec and image    # ap-northeast-2
    ↓
Create the MCI

Next Steps

⏭️ Test and update Tumblebug VPN features/APIs for mc-terrarium v0.1.0 compatibility

Future Scope

The OpenBao integration is currently a minimal baseline. Looking forward to contributions to extend and improve its scope.

Ref: #2350 (Task 1)

@yunkon-kim
Add OpenBao and mc-terrarium integration
916164b 
- Add OpenBao service for centralized CSP credential management
- Integrate mc-terrarium v0.1.0 for infrastructure enrichment (VPN)
- Add auto-init/unseal logic for OpenBao in Makefile
- Register CSP credentials to OpenBao via init.py
- Remove .env from tracking, add .env.example template
- Update docker-compose.yaml with mc-terrarium and OpenBao services
- Simplify API auth to plaintext for dev (remove bcrypt)
@github-actions github-actions bot added docs Improvements or additions to documentation script labels Mar 9, 2026
seokho-son
seokho-son reviewed Mar 9, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@seokho-son seokho-son left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yunkon-kim

Makefile Outdated
@echo ""
@echo " 💡 During 'make init', you'll be asked if you want to use the pre-built"
@echo " 💡 After container restart: 'make up' auto-unseals OpenBao."
@echo " 💡 'make init' registers credentials to both Tumblebug and OpenBao,"
Copy link
Copy Markdown
Member

@seokho-son seokho-son Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yunkon-kim
make up ▶ make gen-cred ▶ (edit credentials) ▶ make enc-cred ▶ make init"

관련하여, 혹시 make compose 와 make up 를
구분하여 사용하게 하려는 의도가 있으셨던 것인지 문의 드립니다.

기존에, make up 은 make compose 와 동일한 기능이었고, make compose 라는 표현은 사실 deprecate를 대비하며 기존 사용자들을 위해서 남겨뒀던 키워드였습니다.

컨테이너 빌드 모드로 처리할지 여부를 구분하는 방법이 아니긴 했습니다. :)

Copy link
Copy Markdown
Member

@seokho-son seokho-son Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

make up (기본 빌드모드. 컨테이너 빌드 해제하려면 docker-compose.yaml 에서 build 파트 주석 처리), make ps, make down. 이런 식으로 짧은 커맨드로 유도하고 있었습니다. ;)

Copy link
Copy Markdown
Member Author

@yunkon-kim yunkon-kim Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@seokho-son

원래 Tumblebug의 의도대로 1가지 방식으로 통일해 놓겠습니다 :)

Copy link
Copy Markdown
Member Author

@yunkon-kim yunkon-kim Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@seokho-son

script/set-tb.sh와 README 에서 ./init/genCredential.sh, ./init/encCredential.sh를 사용하는 부분이 있던데요. make gen-cred, make enc-cred 로 각각 수정해 놓겠습니다.

@yunkon-kim
Restore make command to match Tumblebug standard
eda4f90 
- Restore `make up` as alias for `make compose`
- Define start up and auto init/unseal logic on `make compose`
- Update docs to use `make up`
- Update Makefile help descriptions
@yunkon-kim
Copy link
Copy Markdown
Member Author

yunkon-kim commented Mar 9, 2026

@seokho-son

코멘트 반영을 위한 업데이트를 진행했습니다.

  • 업데이트 후 테스트 결과: Passed
  • 본문 설명에서 make compose를 make up으로 수정

@seokho-son
Copy link
Copy Markdown
Member

seokho-son commented Mar 9, 2026

/approve

@github-actions github-actions bot added the approved This PR is approved and will be merged soon. label Mar 9, 2026
@cb-github-robot cb-github-robot merged commit 5e8a8fc into cloud-barista:main Mar 9, 2026
4 checks passed
@yunkon-kim
Copy link
Copy Markdown
Member Author

yunkon-kim commented Mar 10, 2026

Feel free to report any further issues in #2350 or create a new issue.

@seokho-son seokho-son mentioned this pull request Mar 10, 2026
Closed
2 tasks
@yunkon-kim yunkon-kim deleted the 260309-17 branch March 17, 2026 01:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@seokho-son seokho-son seokho-son left review comments

@github-actions github-actions[bot] github-actions[bot] approved these changes

@hanizang77 hanizang77 Awaiting requested review from hanizang77

Assignees

No one assigned

Labels

approved This PR is approved and will be merged soon. docs Improvements or additions to documentation script

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@yunkon-kim @seokho-son @cb-github-robot