feat(openbao-migrations): support optional JWT issuer override

[sparve-nv]

Closes #246

Summary

Adds an optional JWT_ISSUER_OVERRIDE to the OpenBao migrations so the JWT iss
claim stamped into the generated secret roles can be overridden, and hardens the
role-JSON construction by building it with jq.

What changed

• migrations/utils/functions.sh — generate_jwt_secret_role accepts an optional
  issuer-override argument; when non-empty it replaces the derived
  http://<service>.<namespace>.svc.cluster.local issuer. The role JSON is now built
  with jq -n --arg/--argjson instead of a heredoc, so every string value is escaped
  correctly (quotes, backslashes, control characters).
• 09_setup_nvcf-api.sh, 14_setup_nvca.sh, 15_setup_nvca-operator.sh,
  20_setup_nvct.sh, addons/nvcf-ui/setup_nvcf-ui.sh — pass through
  ${JWT_ISSUER_OVERRIDE:-} for the relevant signer role.
• job.yaml — expose JWT_ISSUER_OVERRIDE (empty by default) as an example env var.

Why

Lets the migrations run with a custom issuer where the default in-cluster issuer isn't
appropriate, without forking the scripts. The jq-based construction also removes a
class of JSON-escaping bugs from shell interpolation.

Backward compatibility

JWT_ISSUER_OVERRIDE defaults to empty; when unset, the derived per-service issuer and
the exact role-JSON shape are unchanged, so existing deployments are unaffected.

Testing

• bash -n on all modified scripts.
• Verified the jq-built role JSON is byte-equivalent to the previous heredoc output for
  the default (no-override) case, and that a set override is reflected in the minted
  token's iss claim.

[coderabbitai]

📝 Walkthrough

Walkthrough

SIS JWT secret-role generation now accepts an optional JWT_ISSUER_OVERRIDE. The shared generator applies the override and builds escaped JSON with jq; the migration Job and SIS setup scripts pass the configured value through.

Changes

JWT issuer override

Layer / File(s)	Summary
JWT role generation migrations/openbao/migrations/utils/functions.sh	generate_jwt_secret_role accepts an optional issuer override and constructs the role JSON with jq.
Migration issuer configuration migrations/openbao/job.yaml, migrations/openbao/addons/nvcf-ui/setup_nvcf-ui.sh, migrations/openbao/migrations/09_setup_nvcf-api.sh, migrations/openbao/migrations/14_setup_nvca.sh, migrations/openbao/migrations/15_setup_nvca-operator.sh, migrations/openbao/migrations/20_setup_nvct.sh	The Job defines JWT_ISSUER_OVERRIDE, and SIS role-generation calls pass its value with an empty fallback.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding optional JWT issuer override support to OpenBao migrations.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@migrations/openbao/migrations/utils/functions.sh`:
- Line 483: Update the quoted_scopes construction in the scopes-processing
function to stop hand-building JSON with sed. Use jq to split the raw scopes
string, preserve valid escaping and quoting, and explicitly convert an empty
SCOPES value to an empty JSON array rather than an array containing an empty
string.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: a71b4c11-bce6-4e87-989f-4f798c1a380f

📥 Commits

Reviewing files that changed from the base of the PR and between ed2f0bd and 26e126c.

📒 Files selected for processing (7)

• migrations/openbao/addons/nvcf-ui/setup_nvcf-ui.sh
• migrations/openbao/job.yaml
• migrations/openbao/migrations/09_setup_nvcf-api.sh
• migrations/openbao/migrations/14_setup_nvca.sh
• migrations/openbao/migrations/15_setup_nvca-operator.sh
• migrations/openbao/migrations/20_setup_nvct.sh
• migrations/openbao/migrations/utils/functions.sh

[balajinvda]

🎉 This PR is included in version nvcf-openbao-migrations-v0.17.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀