So there used to be these little Hare Krishna stickers in New Mayapura during the 1980s. My mum still has a couple of rolls of them and occasionally sends me a present with one on. They’re very precious to me, so I’ve scanned them at a reasonable resolution, but these 160x160 ones are usable for icons and and the web.

Build k8s cluster

Out of scope 🙃

Build OpenBao

Easy Mode: https://github.com/thejambavan/openbao-compose Ouroboros Mode: https://openbao.org/docs/platform/k8s/

Add BSO to k8s cluster

Install the secrets operator helm chart:

helm install vault-secrets-operator hashicorp/vault-secrets-operator --namespace openbao-secrets-operator --create-namespace

Unfortunately you can’t yet do this because the openbao version hasn’t been uploaded to the helm repo:

helm install openbao-secrets-operator openbao/openbao-secrets-operator --namespace openbao-secrets-operator --create-namespace

k8s configuration

Create an appropriate namespace and connect k8s ↔️ openbao

kubectl create namespace openbao

export K8S_TO_VAULT=bao.tunstall.in

curl -vk https://$K8S_TO_VAULT

Note: SSH port-forwarding tricks do not work here!

tl;dr AppArmor can break DDNS on Debian

Also posted as a comment on ISC’s gitlab. The real solution, of course, is to stop using the now-EOL ISC dhcpd and migrate to Kea, but Kea’s architecture is obviously different from dhcpd’s, so migration of a complex configuration will take time.

If anyone else finds it useful, I’ve discovered that this error is due to incomplete AppArmor profiles in Debian < 12:

Oct 14 14:48:48 firewall dhcpd[1177]: DHCPREQUEST for 192.168.1.123 from xx:xx:xx:xx:xx:xx (clientname) via enp2s0
Oct 14 14:48:48 firewall dhcpd[1177]: data: host_decl_name: not available
Oct 14 14:48:48 firewall dhcpd[1177]: DHCPACK on 192.168.1.123 to xx:xx:xx:xx:xx:xx (clientname) via enp2s0
Oct 14 14:50:57 firewall dhcpd[1177]: DDNS: cleaning up lease pointer for a cancel cb=0x7f21e013af20
Oct 14 14:50:57 firewall dhcpd[1177]: Unable to add forward map from clientname.fqdn to 192.168.1.123: operation canceled

Upgrading Debian’s isc-dhcp-server package to the latest (4.4.3-P1-2) brings in an updated AppArmor profile.