feat(openbao): import the JWT secrets plugin under infra/openbao

.github/workflows/openbao-jwt-plugin.yml

@@ -0,0 +1,85 @@
+# SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Build and test the OpenBao JWT secrets plugin.
+#
+# This module is deliberately NOT in go.work.bazel and has no BUILD.bazel, so
+# the Bazel matrix in bazel.yml never sees it. That is the point: its graph is
+# 278 modules including hashicorp/vault/api and hashicorp/vault/sdk, none of
+# which the root module uses today. Joining the root graph would put all of it
+# into minimal version selection for every service in the repository, to build
+# one plugin binary that ships inside a single image.
+#
+# The cost of that isolation is that nothing else would compile or test this
+# code, and NVIDIA now owns modifications to it. Hence this job: plain go,
+# scoped to the one directory, so the tests actually run.
+
+name: openbao-jwt-plugin
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'infra/openbao/plugins/vault-plugin-secrets-jwt/**'
+      - '.github/workflows/openbao-jwt-plugin.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'infra/openbao/plugins/vault-plugin-secrets-jwt/**'
+      - '.github/workflows/openbao-jwt-plugin.yml'
+  merge_group:
+    types: [checks_requested]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: openbao-jwt-plugin-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build-test:
+    name: build and test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: infra/openbao/plugins/vault-plugin-secrets-jwt
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: infra/openbao/plugins/vault-plugin-secrets-jwt/go.mod
+          cache-dependency-path: infra/openbao/plugins/vault-plugin-secrets-jwt/go.sum
+
+      - name: Build
+        run: go build ./...
+
+      - name: Test
+        run: go test ./...
+
+      # The plugin must not regain a dependency on friendlyid-go. That project
+      # carries no license and is not redistributable; plugin/friendlyid.go is
+      # the independently authored replacement. A `go get` that reintroduces it
+      # would be a licensing regression, not a build failure, so nothing else
+      # would catch it.
+      - name: Assert no unlicensed dependency
+        run: |
+          # Capture first rather than piping into grep. Inside `if`, a failing
+          # `go list` would otherwise read as "dependency absent", and under
+          # pipefail grep can close the pipe on a match and leave go list
+          # killed by SIGPIPE. Either way the gate would pass while blind.
+          modules="$(go list -m all)" || {
+            echo "::error::failed to enumerate the Go module graph" >&2
+            exit 1
+          }
+          if grep -Fq 'github.com/mariuszs/friendlyid-go' <<<"$modules"; then
+            echo "::error::friendlyid-go is back in the module graph; it carries no license and cannot be redistributed" >&2
+            exit 1
+          fi
+          echo "friendlyid-go absent from the module graph"

NOTICE

@@ -11,6 +11,7 @@ The following third-party licenses are included in this repository:
     deploy/helm/container-cache/NOTICE
     deploy/helm/nats/NOTICE
     deploy/helm/openbao/NOTICE
+    infra/openbao/plugins/vault-plugin-secrets-jwt/NOTICE
     src/compute-plane-services/byoo-otel-collector/NOTICE
     src/compute-plane-services/ess-agent/NOTICE
     src/compute-plane-services/image-credential-helper/vendor/dario.cat/mergo/LICENSE

dependencies.md

@@ -224,6 +224,7 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Go`: `github.com/golang/mock`
 - `Go`: `github.com/google/btree`
 - `Go`: `github.com/google/cel-go`
+- `Go`: `github.com/google/certificate-transparency-go`
 - `Go`: `github.com/google/gnostic-models`
 - `Go`: `github.com/google/go-containerregistry`
 - `Go`: `github.com/google/go-tpm`
@@ -241,6 +242,7 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Go`: `github.com/inconshreveable/mousetrap`
 - `Go`: `github.com/ionos-cloud/sdk-go/v6`
 - `Go`: `github.com/jmespath/go-jmespath`
+- `Go`: `github.com/joshlf/go-acl`
 - `Go`: `github.com/klauspost/compress`
 - `Go`: `github.com/kylelemons/godebug`
 - `Go`: `github.com/lightstep/go-expohisto`
@@ -332,6 +334,7 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Go`: `github.com/outcaste-io/ristretto`
 - `Go`: `github.com/pb33f/jsonpath`
 - `Go`: `github.com/pb33f/ordered-map/v2`
+- `Go`: `github.com/petermattis/goid`
 - `Go`: `github.com/prometheus/alertmanager`
 - `Go`: `github.com/prometheus/client_golang`
 - `Go`: `github.com/prometheus/client_golang/exp`
@@ -347,12 +350,14 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Go`: `github.com/run-ai/karta`
 - `Go`: `github.com/santhosh-tekuri/jsonschema/v5`
 - `Go`: `github.com/santhosh-tekuri/jsonschema/v6`
+- `Go`: `github.com/sasha-s/go-deadlock`
 - `Go`: `github.com/scaleway/scaleway-sdk-go`
 - `Go`: `github.com/spf13/afero`
 - `Go`: `github.com/spf13/cobra`
 - `Go`: `github.com/spiffe/go-spiffe/v2`
 - `Go`: `github.com/stackitcloud/stackit-sdk-go/core`
 - `Go`: `github.com/synadia-io/callout.go`
+- `Go`: `github.com/tink-crypto/tink-go/v2`
 - `Go`: `github.com/tklauser/numcpus`
 - `Go`: `github.com/ua-parser/uap-go`
 - `Go`: `github.com/vishvananda/netlink`
@@ -481,6 +486,7 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Go`: `google.golang.org/grpc/cmd/protoc-gen-go-grpc`
 - `Go`: `gopkg.in/go-jose/go-jose.v2`
 - `Go`: `gopkg.in/ini.v1`
+- `Go`: `gopkg.in/square/go-jose.v2`
 - `Go`: `gopkg.in/yaml.v2`
 - `Go`: `gopkg.in/yaml.v3`
 - `Go`: `gotest.tools/v3`
@@ -1148,6 +1154,7 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Go`: `github.com/gosuri/uitable`
 - `Go`: `github.com/gregjones/httpcache`
 - `Go`: `github.com/hashicorp/go-hclog`
+- `Go`: `github.com/hashicorp/go-hmac-drbg`
 - `Go`: `github.com/hashicorp/go-metrics`
 - `Go`: `github.com/hashicorp/go-msgpack/v2`
 - `Go`: `github.com/hashicorp/go-syslog`
@@ -1395,16 +1402,20 @@ Generated by `go run ./tools/collect-dependencies`. Refresh: `go run ./tools/col
 - `Go`: `github.com/hashicorp/go-gatedio`
 - `Go`: `github.com/hashicorp/go-immutable-radix`
 - `Go`: `github.com/hashicorp/go-kms-wrapping/entropy/v2`
+- `Go`: `github.com/hashicorp/go-kms-wrapping/v2`
 - `Go`: `github.com/hashicorp/go-memdb`
 - `Go`: `github.com/hashicorp/go-multierror`
 - `Go`: `github.com/hashicorp/go-plugin`
 - `Go`: `github.com/hashicorp/go-retryablehttp`
 - `Go`: `github.com/hashicorp/go-rootcerts`
 - `Go`: `github.com/hashicorp/go-secure-stdlib/awsutil`
 - `Go`: `github.com/hashicorp/go-secure-stdlib/base62`
+- `Go`: `github.com/hashicorp/go-secure-stdlib/cryptoutil`
 - `Go`: `github.com/hashicorp/go-secure-stdlib/mlock`
 - `Go`: `github.com/hashicorp/go-secure-stdlib/parseutil`
 - `Go`: `github.com/hashicorp/go-secure-stdlib/password`
+- `Go`: `github.com/hashicorp/go-secure-stdlib/permitpool`
+- `Go`: `github.com/hashicorp/go-secure-stdlib/plugincontainer`
 - `Go`: `github.com/hashicorp/go-secure-stdlib/strutil`
 - `Go`: `github.com/hashicorp/go-secure-stdlib/tlsutil`
 - `Go`: `github.com/hashicorp/go-sockaddr`

infra/openbao/.license-header.txt

@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+

infra/openbao/Dockerfile

@@ -0,0 +1,35 @@
+# The JWT secrets plugin is compiled here rather than copied in prebuilt.
+#
+# It used to come from scripts/build-jwt-plugin.sh, which cloned a fork hosted
+# outside this repository at a pinned revision and dropped the binaries into
+# files/plugins/. That made the image unbuildable from public source, so the
+# binaries had to reach the build some other way: committed to git, or injected
+# as a private overlay the way the cassandra image takes its exporter jar.
+#
+# Neither is needed now. The plugin source lives at plugins/ inside this build
+# context, so the stage below compiles it from the same commit that produces
+# the image. Nothing is vendored and nothing is injected, so `docker build .`
+# here produces the same image as the release pipeline.
+ARG BAO_VERSION=2.5.5
+ARG GO_VERSION=1.25
+
+FROM golang:${GO_VERSION}-alpine AS plugin-build
+ARG TARGETARCH
+WORKDIR /src
+# Module files first so dependency download caches independently of source edits.
+COPY plugins/vault-plugin-secrets-jwt/go.mod plugins/vault-plugin-secrets-jwt/go.sum ./
+RUN go mod download
+COPY plugins/vault-plugin-secrets-jwt/ ./
+# CGO_ENABLED=0 for a static binary: the plugin is exec'd by the OpenBao server
+# inside a distro image it was not linked against, so it must not need a
+# dynamic loader. -trimpath keeps build paths out of the binary.
+RUN GOOS=linux GOARCH="${TARGETARCH}" CGO_ENABLED=0 \
+    go build -trimpath -o /out/vault-plugin-secrets-jwt ./cmd/vault-plugin-secrets-jwt
+
+FROM openbao/openbao:${BAO_VERSION}
+
+# hadolint ignore=DL3018
+RUN apk add --no-cache curl jq bash && \
+    mkdir -p /openbao/plugins
+
+COPY --from=plugin-build --chmod=0555 /out/vault-plugin-secrets-jwt /openbao/plugins/vault-plugin-secrets-jwt

infra/openbao/README.md

@@ -0,0 +1,73 @@
+# NVCF OpenBao
+
+Container image used by NVCF deployments to run [OpenBao](https://openbao.org/), bundled with the additional vault plugin(s) NVCF expects at runtime.
+
+## Overview
+
+This repository ships:
+
+- A multi-arch container image definition (`Dockerfile`) layered on top of `openbao/openbao`
+- A directory (`files/plugins/`) where the user supplies the vault plugin binary at build time
+
+## Plugin binaries
+
+The image expects an OS-specific plugin binary at build time, placed at:
+
+- `files/plugins/vault-plugin-secrets-jwt-linux-amd64` (for `--platform linux/amd64`)
+- `files/plugins/vault-plugin-secrets-jwt-linux-arm64` (for `--platform linux/arm64`)
+
+The plugin is built from source in this repository, at
+`plugins/vault-plugin-secrets-jwt`. Nothing needs to be cloned or placed by
+hand, and no binaries are committed.
+
+The image build compiles it in a Dockerfile build stage, so `docker build .`
+here produces the same image as the release pipeline:
+
+```bash
+docker build --build-arg TARGETARCH=amd64 -t nvcf-openbao:local .
+```
+
+To produce the binaries outside an image build, for local inspection or to run
+the verifier:
+
+```bash
+scripts/build-jwt-plugin.sh     # writes both arch binaries to files/plugins/
+scripts/verify-jwt-plugin.sh    # asserts module path, target, toolchain, deps
+```
+
+`files/plugins/` is gitignored apart from `.gitkeep`; see
+`files/plugins/PROVENANCE.md` for the dependency floors the verifier enforces.
+
+## Prerequisites
+
+- Docker or another OCI-compatible builder (with `buildx` for multi-arch)
+- A built copy of `vault-plugin-secrets-jwt` for each platform you target, placed in `files/plugins/`
+
+## Building the container
+
+The `Dockerfile` defaults to the `openbao/openbao:2.5.5` base image. Override the `BAO_VERSION` build-arg to track a different upstream tag.
+
+```bash
+docker build \
+  --build-arg TARGETARCH=amd64 \
+  --build-arg BAO_VERSION=2.5.5 \
+  -t <your-registry>/<your-org>/nvcf-openbao:<version> .
+```
+
+For multi-arch builds:
+
+```bash
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  --build-arg BAO_VERSION=2.5.5 \
+  -t <your-registry>/<your-org>/nvcf-openbao:<version> \
+  --push .
+```
+
+## Image contents
+
+At runtime the image provides:
+
+- The upstream OpenBao server (`/usr/local/bin/bao`)
+- Alpine packages `curl`, `jq`, and `bash` (used by entrypoint scripts in consumers such as the migrations Job)
+- `/openbao/plugins/vault-plugin-secrets-jwt` - the JWT secrets plugin built from `outfoxx/vault-plugin-secrets-jwt`

infra/openbao/files/plugins/.gitignore

@@ -0,0 +1 @@
+vault-plugin-secrets-jwt-linux-*

infra/openbao/files/plugins/PROVENANCE.md

@@ -0,0 +1,35 @@
+# JWT plugin provenance
+
+The `vault-plugin-secrets-jwt` binaries in this directory are build output.
+They are not committed; `.gitignore` excludes them and only `.gitkeep` ships.
+
+## Source
+
+`../../plugins/vault-plugin-secrets-jwt` in this repository. The plugin is a
+modified copy of the Apache-2.0 project `outfoxx/vault-plugin-secrets-jwt`;
+that directory's `NOTICE` enumerates every NVIDIA change.
+
+The image build compiles the plugin from that source in a Dockerfile build
+stage, so the binary and the image come from the same commit. Nothing is
+fetched from outside this repository at build time.
+
+## Dependency floors
+
+Held deliberately, not incidental to a `go mod tidy`:
+
+- `golang.org/x/net v0.55.0` - security floor
+- `github.com/hashicorp/vault/api v1.15.0`
+- `github.com/hashicorp/vault/sdk v0.15.2`
+- `google.golang.org/grpc v1.69.4`
+- `github.com/go-jose/go-jose/v4 v4.0.4`
+
+The vault and grpc pins keep compatibility with the previously shipped plugin
+binary. `scripts/verify-jwt-plugin.sh` asserts them against the built artifact.
+
+## Local build
+
+    scripts/build-jwt-plugin.sh    # writes both arch binaries here
+    scripts/verify-jwt-plugin.sh   # asserts module path, target, toolchain, deps
+
+Hashes are reported by the verifier rather than pinned: any source change in
+this repository legitimately changes them.

infra/openbao/plugins/vault-plugin-secrets-jwt/AGENTS.md

@@ -0,0 +1,30 @@
+# vault-plugin-secrets-jwt
+
+Third-party code. This is a modified copy of
+[outfoxx/vault-plugin-secrets-jwt](https://github.com/outfoxx/vault-plugin-secrets-jwt),
+Apache-2.0, Copyright 2021 Outfox, Inc. Read `NOTICE` before changing anything
+here; it enumerates every NVIDIA modification, which Apache-2.0 section 4(b)
+requires us to keep accurate.
+
+## Rules
+
+Do not run the repository copyright stamper over this directory. Files that
+carry the upstream Outfox header must keep it. Add an NVIDIA header only to a
+file NVIDIA authored, and record the change in `NOTICE` in the same commit.
+
+The Go module path is
+`github.com/NVIDIA/nvcf/infra/openbao/plugins/vault-plugin-secrets-jwt`, which
+deliberately differs from the upstream path. We do not track upstream, so the
+path was changed to resolve inside this repository rather than to keep diffs
+against Outfox readable.
+
+There is no dependency on `github.com/mariuszs/friendlyid-go` and there must
+not be one. That project carries no license and is not redistributable;
+`plugin/friendlyid.go` is the independently authored replacement.
+
+## Build and test
+
+    go build ./...
+    go test ./...
+
+The image build that consumes this lives in `infra/openbao`.

infra/openbao/plugins/vault-plugin-secrets-jwt/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

infra/openbao/plugins/vault-plugin-secrets-jwt/HEADER

@@ -0,0 +1,14 @@
+Copyright 2021 Outfox, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+