CI: Rework Hashicorp Vault jobs into OpenBao

Change-Id: I1a8ebc171da8990b21f03e6d5c3da296eef92e28
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>

6 files changed, 113 insertions, 115 deletions

diff --git a/tests/run-hashi-vault.yml b/tests/run-openbao.yml
index f9a014e76..f8d2fe259 100644
--- a/tests/run-hashi-vault.yml
+++ b/tests/run-openbao.yml
@@ -68,10 +68,10 @@
       command: "{{ kolla_ansible_venv_path }}/bin/kolla-genpwd"
 
     # At this point we have generated all necessary configuration, and are
-    # ready to test Hashicorp Vault.
-    - name: Run test-hashicorp-vault-passwords.sh script
+    # ready to test OpenBao.
+    - name: Run test-openbao-passwords.sh script
       script:
-        cmd: test-hashicorp-vault-passwords.sh
+        cmd: test-openbao-passwords.sh
         executable: /bin/bash
         chdir: "{{ kolla_ansible_src_dir }}"
       environment:
@@ -85,11 +85,11 @@
 
     - name: Read generated file
       slurp:
-        src: "/tmp/passwords-hashicorp-vault.yml"
+        src: "/tmp/passwords-openbao.yml"
       register: generated_file
 
     # This test will load in the original input file and the one that was
-    # generated by Vault and ensure that the keys are the same in both files.
+    # generated by OpenBao and ensure that the keys are the same in both files.
     # This ensures that we are not missing any passwords.
     - name: Check passwords that were written to Vault are as expected
       vars:
diff --git a/tests/test-hashicorp-vault-passwords.sh b/tests/test-hashicorp-vault-passwords.sh
deleted file mode 100755
index 64648d500..000000000
--- a/tests/test-hashicorp-vault-passwords.sh
+++ /dev/null
@@ -1,69 +0,0 @@
-#!/bin/bash
-
-set -o xtrace
-set -o errexit
-
-export PYTHONUNBUFFERED=1
-
-function install_vault {
-    if [[ $BASE_DISTRO =~ (debian|ubuntu) ]]; then
-        curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
-        sudo apt-add-repository -y "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
-        sudo apt-get update -y && sudo apt-get install -y vault jq
-    else
-        sudo dnf install -y yum-utils
-        sudo dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
-        sudo dnf install -y vault jq
-    fi
-}
-
-function start_vault {
-    nohup vault server --dev &
-    # Give Vault some time to warm up
-    sleep 10
-}
-
-function test_vault {
-    TOKEN=$(vault token create -address 'http://127.0.0.1:8200' -format json | jq '.auth.client_token' --raw-output)
-    echo "${TOKEN}" | vault login -address 'http://127.0.0.1:8200' -
-    vault kv put -address 'http://127.0.0.1:8200' secret/foo data=bar
-}
-
-function test_writepwd {
-    TOKEN=$(vault token create -address 'http://127.0.0.1:8200' -format json | jq '.auth.client_token' --raw-output)
-    kolla-writepwd \
-        --passwords /etc/kolla/passwords.yml \
-        --vault-addr 'http://127.0.0.1:8200' \
-        --vault-token ${TOKEN} \
-        --vault-mount-point secret
-}
-
-function test_readpwd {
-    TOKEN=$(vault token create -address 'http://127.0.0.1:8200' -format json | jq '.auth.client_token' --raw-output)
-    cp etc/kolla/passwords.yml /tmp/passwords-hashicorp-vault.yml
-    kolla-readpwd \
-        --passwords /tmp/passwords-hashicorp-vault.yml \
-        --vault-addr 'http://127.0.0.1:8200' \
-        --vault-token ${TOKEN} \
-        --vault-mount-point secret
-}
-
-function teardown {
-    pkill vault
-}
-
-function test_hashicorp_vault_passwords {
-    echo "Setting up development Vault server..."
-    source $KOLLA_ANSIBLE_VENV_PATH/bin/activate
-    install_vault
-    start_vault
-    test_vault
-    echo "Write passwords to Hashicorp Vault..."
-    test_writepwd
-    echo "Read passwords from Hashicorp Vault..."
-    test_readpwd
-    echo "Cleaning up..."
-    teardown
-}
-
-test_hashicorp_vault_passwords
diff --git a/tests/test-openbao-passwords.sh b/tests/test-openbao-passwords.sh
new file mode 100755
index 000000000..5e6b115ba
--- /dev/null
+++ b/tests/test-openbao-passwords.sh
@@ -0,0 +1,67 @@
+#!/bin/bash
+
+set -o xtrace
+set -o errexit
+
+export PYTHONUNBUFFERED=1
+
+function install_openbao {
+    if [[ $BASE_DISTRO =~ (debian|ubuntu) ]]; then
+        curl -fsSLO https://github.com/openbao/openbao/releases/download/v2.4.1/bao_2.4.1_linux_amd64.deb
+        sudo dpkg -i bao_2.4.1_linux_amd64.deb
+        rm -f bao_2.4.1_linux_amd64.deb
+    else
+        sudo dnf install -y https://github.com/openbao/openbao/releases/download/v2.4.1/bao_2.4.1_linux_amd64.rpm
+    fi
+}
+
+function start_openbao {
+    nohup bao server --dev &
+    # Give Vault some time to warm up
+    sleep 10
+}
+
+function test_openbao {
+    TOKEN=$(bao token create -address 'http://127.0.0.1:8200' -field token)
+    echo "${TOKEN}" | bao login -address 'http://127.0.0.1:8200' -
+    bao kv put -address 'http://127.0.0.1:8200' secret/foo data=bar
+}
+
+function test_writepwd {
+    TOKEN=$(bao token create -address 'http://127.0.0.1:8200' -field token)
+    kolla-writepwd \
+        --passwords /etc/kolla/passwords.yml \
+        --vault-addr 'http://127.0.0.1:8200' \
+        --vault-token ${TOKEN} \
+        --vault-mount-point secret
+}
+
+function test_readpwd {
+    TOKEN=$(bao token create -address 'http://127.0.0.1:8200' -field token)
+    cp etc/kolla/passwords.yml /tmp/passwords-openbao.yml
+    kolla-readpwd \
+        --passwords /tmp/passwords-openbao.yml \
+        --vault-addr 'http://127.0.0.1:8200' \
+        --vault-token ${TOKEN} \
+        --vault-mount-point secret
+}
+
+function teardown {
+    pkill bao
+}
+
+function test_openbao_passwords {
+    echo "Setting up development OpenBao server..."
+    source $KOLLA_ANSIBLE_VENV_PATH/bin/activate
+    install_openbao
+    start_openbao
+    test_openbao
+    echo "Write passwords to OpenBao..."
+    test_writepwd
+    echo "Read passwords from OpenBao..."
+    test_readpwd
+    echo "Cleaning up..."
+    teardown
+}
+
+test_openbao_passwords
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 77e714e1a..ed9c7b718 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -12,7 +12,7 @@
       # https://review.opendev.org/c/openstack/kolla-ansible/+/864780
       # - kolla-ansible-scenario-container-engine-migration
       - kolla-ansible-scenario-haproxy-fqdn
-      - kolla-ansible-scenario-hashi-vault
+      - kolla-ansible-scenario-openbao
       - kolla-ansible-scenario-kvm
       - kolla-ansible-scenario-lets-encrypt
       - kolla-ansible-scenario-magnum
diff --git a/zuul.d/scenarios/hashi-vault.yaml b/zuul.d/scenarios/hashi-vault.yaml
deleted file mode 100644
index a267aa455..000000000
--- a/zuul.d/scenarios/hashi-vault.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
----
-- job:
-    name: kolla-ansible-hashi-vault-base
-    parent: kolla-ansible-base
-    run: tests/run-hashi-vault.yml
-    required-projects:
-      - openstack/kolla-ansible
-      - openstack/requirements
-    voting: false
-    files: !override
-      - ^kolla_ansible/
-      - ^requirements-core.yml
-      - ^tests/(pre|run|run-hashi-vault).yml
-      - ^tests/templates/(inventory|globals-default).j2
-      - ^tests/test-hashicorp-vault-passwords.sh
-
-- job:
-    name: kolla-ansible-debian-bookworm-hashi-vault
-    parent: kolla-ansible-hashi-vault-base
-    nodeset: kolla-ansible-debian-bookworm-8GB
-
-- job:
-    name: kolla-ansible-rocky-10-hashi-vault
-    parent: kolla-ansible-hashi-vault-base
-    nodeset: kolla-ansible-rocky-10-8GB
-
-- job:
-    name: kolla-ansible-ubuntu-noble-hashi-vault
-    parent: kolla-ansible-hashi-vault-base
-    nodeset: kolla-ansible-ubuntu-noble-8GB
-
-- project-template:
-    name: kolla-ansible-scenario-hashi-vault
-    description: |
-      Runs Kolla-Ansible Hashicorp Vault scenario jobs.
-    check:
-      jobs:
-        - kolla-ansible-debian-bookworm-hashi-vault
-        - kolla-ansible-rocky-10-hashi-vault
-        - kolla-ansible-ubuntu-noble-hashi-vault
diff --git a/zuul.d/scenarios/openbao.yaml b/zuul.d/scenarios/openbao.yaml
new file mode 100644
index 000000000..1cca53ec3
--- /dev/null
+++ b/zuul.d/scenarios/openbao.yaml
@@ -0,0 +1,40 @@
+---
+- job:
+    name: kolla-ansible-openbao-base
+    parent: kolla-ansible-base
+    run: tests/run-openbao.yml
+    required-projects:
+      - openstack/kolla-ansible
+      - openstack/requirements
+    voting: false
+    files: !override
+      - ^kolla_ansible/
+      - ^requirements-core.yml
+      - ^tests/(pre|run|run-openbao).yml
+      - ^tests/templates/(inventory|globals-default).j2
+      - ^tests/test-openbao-passwords.sh
+
+- job:
+    name: kolla-ansible-debian-bookworm-openbao
+    parent: kolla-ansible-openbao-base
+    nodeset: kolla-ansible-debian-bookworm-8GB
+
+- job:
+    name: kolla-ansible-rocky-10-openbao
+    parent: kolla-ansible-openbao-base
+    nodeset: kolla-ansible-rocky-10-8GB
+
+- job:
+    name: kolla-ansible-ubuntu-noble-openbao
+    parent: kolla-ansible-openbao-base
+    nodeset: kolla-ansible-ubuntu-noble-8GB
+
+- project-template:
+    name: kolla-ansible-scenario-openbao
+    description: |
+      Runs Kolla-Ansible OpenBao scenario jobs.
+    check:
+      jobs:
+        - kolla-ansible-debian-bookworm-openbao
+        - kolla-ansible-rocky-10-openbao
+        - kolla-ansible-ubuntu-noble-openbao