Setup OpenBao for k8s secrets

[finn@…]

This is a task to setup OpenBao in such a way that it can be easily used to access secrets in k8s. There are a number of outstanding questions to answer before this is applied to the live cluster:

• How do secrets get created?
  • Generated random strings
  • Human provided strings
    • Web UI is supposed to be the answer here, but ​that doesnt seem to be available in the stock container images
      • We can roll our own images for now
  • Integrated external systems
    • Keycloak OIDC client secret?
• How do pods read secrets?
  • ​OpenBao Secrets Operator - is this any good?
  • ​sidecar agent - seems resource intensive
  • ​csi provider - seems limited, can't set envrionment variables
  • ​external secrets operator yet another operator :/ - but none of the other options actually work in OpenBao yet! so this is what we're using.

[Finn]

This is completed as of ​https://git.devhack.net/devhack/core-infra/commit/01c9ab135f418188f7ab5582887d7310222d2b21