feat(openbao): add OpenBao role as external KMS for Percona pg_tde

.gitignore

@@ -8,6 +8,11 @@ files/*.key
 files/*.crt
 files/pki/*
 
+#########################################################
+# openbao init material: root token + recovery shares
+#########################################################
+files/openbao/*
+
 #########################################################
 # vagrant & terraform & docker
 #########################################################

conf/ha/pgtde.yml

@@ -0,0 +1,135 @@
+---
+#==============================================================#
+# File      :   pgtde.yml
+# Desc      :   PG TDE with Percona PostgreSQL 3-node HA template
+# Ctime     :   2025-07-04
+# Mtime     :   2026-07-23
+# Docs      :   https://pigsty.io/docs/conf/pgtde
+# License   :   Apache-2.0 @ https://pigsty.io/docs/about/license/
+# Copyright :   2018-2026  Ruohang Feng / Vonng (rh@vonng.com)
+#==============================================================#
+
+# HA variant of the single-node template with pg_tde
+# currently based on PostgreSQL 18
+# tutorial: https://pigsty.io/docs/pgsql/kernel/percona
+#
+# Usage:
+#   curl https://repo.pigsty.io/get | bash
+#   ./configure -c pgtde
+#   ./deploy.yml
+
+all:
+  children:
+
+    infra:
+      hosts:
+        10.10.10.10: { infra_seq: 1 }
+      vars:
+        repo_enabled: false
+        haproxy_services:
+          - name: openbao                  # [REQUIRED] service name, unique
+            port: 8200                     # [REQUIRED] service port, unique
+            options:                       # [OPTIONAL] openbao health check
+              - option httpchk
+              - http-check send meth GET uri /v1/sys/health
+              - http-check expect status 200
+            servers:
+              - { name: openbao-1 ,ip: 10.10.10.11 ,port: 8200 ,options: 'check-ssl ca-file /etc/pki/ca.crt check' }
+              - { name: openbao-2 ,ip: 10.10.10.12 ,port: 8200 ,options: 'check-ssl ca-file /etc/pki/ca.crt check' }
+              - { name: openbao-3 ,ip: 10.10.10.13 ,port: 8200 ,options: 'check-ssl ca-file /etc/pki/ca.crt check' }
+
+    # etcd cluster for ha postgres
+    etcd:
+      hosts:
+        10.10.10.11: { etcd_seq: 1 }
+        10.10.10.12: { etcd_seq: 2 }
+        10.10.10.13: { etcd_seq: 3 }
+      vars:
+        etcd_cluster: etcd
+
+    # openbao kms cluster for pg_tde
+    openbao:
+      hosts:
+        10.10.10.11: { openbao_seq: 1 }
+        10.10.10.12: { openbao_seq: 2 }
+        10.10.10.13: { openbao_seq: 3 }
+      vars:
+        openbao_cluster: openbao
+
+    #minio:   { hosts: { 10.10.10.10: { minio_seq:   1 }} ,vars: { minio_cluster: minio     }}
+
+    #----------------------------------------------#
+    # Percona Postgres Database Cluster
+    #----------------------------------------------#
+    pg-meta:
+      hosts:
+        10.10.10.21: { pg_seq: 1 , pg_role: primary }
+        10.10.10.22: { pg_seq: 2 , pg_role: replica }
+        10.10.10.23: { pg_seq: 3 , pg_role: replica }
+      vars:
+        pg_mode: pgtde
+        pg_cluster: pg-meta
+        pg_vip_enabled: true
+        pg_vip_address: 10.10.10.20/24
+        pg_users:
+          - { name: dbuser_meta ,password: DBUser.Meta   ,pgbouncer: true ,roles: [dbrole_admin   ] ,comment: pigsty admin user }
+          - { name: dbuser_view ,password: DBUser.Viewer ,pgbouncer: true ,roles: [dbrole_readonly] ,comment: read-only viewer  }
+        pg_databases:
+          - name: meta
+            baseline: cmdb.sql
+            comment: pigsty tde database
+            schemas: [pigsty]
+            extensions: [ pg_tde, vector, postgis, pgaudit, { name: pg_stat_monitor, schema: monitor } ]
+        pg_hba_rules:   # https://pigsty.io/docs/pgsql/config/hba
+          - { user: all ,db: all ,addr: intra ,auth: pwd ,title: 'everyone intranet access with password' ,order: 800 }
+        pg_crontab:     # https://pigsty.io/docs/pgsql/admin/crontab
+          - '00 01 * * * /pg/bin/pg-backup full'
+
+        # Percona PostgreSQL TDE Kernel Settings
+        pg_packages: [ pgtde, pgsql-common ]  # install Pigsty private-prefix Percona packages
+        pg_libs: 'pg_tde, pgaudit, pg_stat_statements, pg_stat_monitor, auto_explain'
+
+  vars:
+    #----------------------------------------------#
+    # INFRA : https://pigsty.io/docs/infra/param
+    #----------------------------------------------#
+    version: v4.5.0                   # pigsty version string
+    admin_ip: 10.10.10.10             # admin node ip address
+    region: default                   # upstream mirror region: default,china,europe
+    infra_portal:                     # infra services exposed via portal
+      home    : { domain: i.pigsty }  # default domain name
+      openbao : { domain: bao.pigsty ,endpoint: "10.10.10.10:8200" ,scheme: https }
+
+    #----------------------------------------------#
+    # NODE : https://pigsty.io/docs/node/param
+    #----------------------------------------------#
+    nodename_overwrite: false             # do not overwrite node hostname on single node mode
+    node_repo_modules: node,infra,pgsql
+    node_tune: oltp
+    node_etc_hosts: ["10.10.10.10 bao.pigsty"]  # domain name to access openbao from all nodes (required)
+
+    #----------------------------------------------#
+    # PGSQL : https://pigsty.io/docs/pgsql/param
+    #----------------------------------------------#
+    pg_version: 18                      # Default Percona TDE PG Major Version is 18
+    pg_conf: oltp.yml                   # pgsql tuning specs: {oltp,olap,tiny,crit}.yml
+
+    #----------------------------------------------#
+    # OPENBAO
+    #----------------------------------------------#
+    openbao_cluster: openbao            # bao cluster & group name, openbao by default
+    openbao_domain: bao.pigsty          # bao domain name, `bao.pigsty` by default
+
+    #----------------------------------------------#
+    # PASSWORD : https://pigsty.io/docs/setup/security/
+    #----------------------------------------------#
+    grafana_admin_password: pigsty
+    grafana_view_password: DBUser.Viewer
+    pg_admin_password: DBUser.DBA
+    pg_monitor_password: DBUser.Monitor
+    pg_replication_password: DBUser.Replicator
+    patroni_password: Patroni.API
+    haproxy_admin_password: pigsty
+    minio_secret_key: S3User.MinIO
+    etcd_root_password: Etcd.Root
+...

conf/pgtde.yml

@@ -20,9 +20,10 @@
 
 all:
   children:
-    infra: { hosts: { 10.10.10.10: { infra_seq: 1 }} ,vars: { repo_enabled: false }}
-    etcd:  { hosts: { 10.10.10.10: { etcd_seq: 1  }} ,vars: { etcd_cluster: etcd  }}
-    #minio: { hosts: { 10.10.10.10: { minio_seq: 1 }} ,vars: { minio_cluster: minio }}
+    infra:   { hosts: { 10.10.10.10: { infra_seq: 1   }} ,vars: { repo_enabled: false      }}
+    etcd:    { hosts: { 10.10.10.10: { etcd_seq: 1    }} ,vars: { etcd_cluster: etcd       }}
+    openbao: { hosts: { 10.10.10.10: { openbao_seq: 1 }} ,vars: { openbao_cluster: openbao }}
+    #minio:   { hosts: { 10.10.10.10: { minio_seq:   1 }} ,vars: { minio_cluster: minio     }}
 
     #----------------------------------------------#
     # Percona Postgres Database Cluster
@@ -41,7 +42,7 @@ all:
             baseline: cmdb.sql
             comment: pigsty tde database
             schemas: [pigsty]
-            extensions: [ vector, postgis, pg_tde ,pgaudit, { name: pg_stat_monitor, schema: monitor } ]
+            extensions: [ pg_tde, vector, postgis ,pgaudit, { name: pg_stat_monitor, schema: monitor } ]
         pg_hba_rules:   # https://pigsty.io/docs/pgsql/config/hba
           - { user: all ,db: all ,addr: intra ,auth: pwd ,title: 'everyone intranet access with password' ,order: 800 }
         pg_crontab:     # https://pigsty.io/docs/pgsql/admin/crontab
@@ -59,21 +60,29 @@ all:
     admin_ip: 10.10.10.10             # admin node ip address
     region: default                   # upstream mirror region: default,china,europe
     infra_portal:                     # infra services exposed via portal
-      home : { domain: i.pigsty }     # default domain name
+      home    : { domain: i.pigsty }  # default domain name
+      openbao : { domain: bao.pigsty ,endpoint: "10.10.10.10:8200" ,scheme: https }
 
     #----------------------------------------------#
     # NODE : https://pigsty.io/docs/node/param
     #----------------------------------------------#
     nodename_overwrite: false             # do not overwrite node hostname on single node mode
     node_repo_modules: node,infra,pgsql
     node_tune: oltp
+    node_etc_hosts: ["10.10.10.10 bao.pigsty"]  # domain name to access openbao from all nodes (required)
 
     #----------------------------------------------#
     # PGSQL : https://pigsty.io/docs/pgsql/param
     #----------------------------------------------#
     pg_version: 18                      # Default Percona TDE PG Major Version is 18
     pg_conf: oltp.yml                   # pgsql tuning specs: {oltp,olap,tiny,crit}.yml
 
+    #----------------------------------------------#
+    # OPENBAO
+    #----------------------------------------------#
+    openbao_cluster: openbao            # bao cluster & group name, openbao by default
+    openbao_domain: bao.pigsty          # bao domain name, `bao.pigsty` by default
+
     #----------------------------------------------#
     # PASSWORD : https://pigsty.io/docs/setup/security/
     #----------------------------------------------#

deploy.yml

@@ -22,16 +22,18 @@
 # - infra         : init nginx, dns, victoria, grafana
 # - node-monitor  : init node-exporter vector
 # - etcd          : init etcd (required for pgsql HA)
+# - openbao       : init openbao (optional for pg_tde)
 # - minio         : init minio (optional)
 # - pgsql         : init pgsql
 # - pgsql-monitor : init pgsql
 #
 # Which is equivalent to the following 4 playbooks altogether:
-# - infra.yml -l infra   deploy infrastructure on group 'infra'
-# - node.yml  -l all     init all nodes
-# - etcd.yml  -l etcd    init etcd on group 'etcd' for pg ha
-# - minio.yml -l <group> init minio hosts marked with minio_cluster
-# - pgsql.yml -l all     init pgsql database clusters on all nodes
+# - infra.yml   -l infra   deploy infrastructure on group 'infra'
+# - node.yml    -l all     init all nodes
+# - etcd.yml    -l etcd    init etcd on group 'etcd' for pg ha
+# - openbao.yml -l openbao init openbao on group 'openbao' for pg_tde
+# - minio.yml   -l <group> init minio hosts marked with minio_cluster
+# - pgsql.yml   -l all     init pgsql database clusters on all nodes
 #==============================================================#
 
 
@@ -115,6 +117,17 @@
   roles: [ { role: etcd } ]   # init etcd on fixed group 'etcd'
 
 
+#---------------------------------------------------------------
+# OPENBAO INIT
+#---------------------------------------------------------------
+- name: OPENBAO INIT
+  become: true
+  hosts: openbao
+  gather_facts: no
+  tags: openbao
+  roles: [ { role: openbao ,when: openbao_cluster is defined } ]
+
+
 #---------------------------------------------------------------
 # MINIO INIT
 #---------------------------------------------------------------