proomt

Search

Search posts, papers, and topics

All posts

CNCFGabriele Bartolini (EnterpriseDB) and CNCF Ambassador, Rob Kenefeck (ControlPlane)16 min readtutorialintermediate

Running OpenBao on Kubernetes with a CloudNativePG PostgreSQL backend

Read on cncf.ioHN 2·0 comments

Summary

Step‑by‑step recipe to run OpenBao (Vault fork) on Kubernetes using CloudNativePG as a password‑less, TLS‑authenticated PostgreSQL storage backend. Shows how to spin up a Kind cluster with the cnpg‑playground, deploy a 3‑node CNPG cluster with synchronous quorum replication, configure DatabaseRole‑based client certificates, set up pg_hba rules, and initialize OpenBao’s schema via a one‑off Job.

  • Use CloudNativePG’s `ClusterImageCatalog` to track minimal PostgreSQL 18 images automatically.
  • Enforce password‑less mTLS for both schema‑owner and application roles via `DatabaseRole` `clientCertificate` and explicit `pg_hba` entries.
  • Leverage CNPG’s node selectors, tolerations, and required pod anti‑affinity to isolate Postgres pods on dedicated nodes across zones.
  • Set secret volume `defaultMode: 0640` so libpq accepts mounted client keys (group‑readable but not world‑readable).

Provides a fully open‑source, vendor‑agnostic secret‑management stack that is self‑healing and HA on any conformant Kubernetes cluster, eliminating password sprawl and cloud‑managed database lock‑in.

6/10
devopssecuritypostgresqlkubernetescloudnativepgopenbao

Related reading

  1. Microsoft Open-Sources TauGrid to Simplify AI Workload Management on Kubernetes

    Microsoft open‑sourced TauGrid, a Helm‑installable platform that bundles Kueue, KubeRay and other components to schedule, monitor and checkpoint AI workloads on GPU‑enabled Kubernetes clusters. Engineers define jobs in a simple `tau.yaml`, and TauGrid handles queuing, health checks, and observability, simplifying AI workload management.

    InfoQinfoq.com2 min

  2. Monitor TAS and gang scheduling for AI training in Kubernetes

    Kubernetes’ default scheduler can’t satisfy AI training’s need for low‑latency GPU interconnects and simultaneous pod start‑up. The blog explains how the open‑source Kueue job queue adds topology‑aware placement (using node labels like `topology.kubernetes.io/rack`) and how the Coscheduling plugin adds a permit phase that only binds a gang of pods when the full set is ready, preventing idle GPU r…

    Datadogdatadoghq.com19 min

  3. Kubernetes Multi-Cluster Project Karmada Reaches CNCF Graduation

    Karmada, a multi-cluster and multi-cloud Kubernetes orchestration project, has graduated to the highest maturity tier within the CNCF. It extends the standard Kubernetes API to manage workloads across diverse environments, enhancing multi-component scheduling for AI training jobs and promoting priority-based scheduling.

    InfoQinfoq.com3 minrelease

  4. The architecture of Neki

    Neki is PlanetScale’s sharding layer for vanilla PostgreSQL that presents a single Postgres endpoint while routing queries across a fleet of Postgres instances. It does this with a set of tightly‑coupled components—Router, Sidecar, PostgresManager, Admin, Operator, and etcd‑backed Data Topology—each handling a specific piece of the scaling, failover, and query‑planning puzzle.

    PlanetScaleplanetscale.com8 min