OpenBao Bootstrap

#runbook #openbao #secrets

  • Use this once after the OpenBao HelmRelease has reconciled. The deployment uses integrated Raft storage and GCP KMS auto-unseal; it starts intentionally empty.

  • Preconditions

    • The Terraform change creating the openbao GCP KMS key has applied through Atlantis.

    • Flux reports the vault HelmRelease Ready in the vault namespace.

    • A 1Password vault is ready to hold the recovery keys and initial root token. Never put them in Git, a terminal recording, or this wiki.

  • Initialize

    • Confirm the pod is running and uninitialized:

    • kubectl --context folly -n vault get pods -l app.kubernetes.io/name=openbao
kubectl --context folly -n vault exec vault-openbao-0 -- bao status

    • Initialize exactly once. Capture the output directly into the approved secret store without pasting it into a shell history or chat:

    • kubectl --context folly -n vault exec -it vault-openbao-0 -- bao operator init

    • Verify the instance is initialized and unsealed:

    • kubectl --context folly -n vault exec vault-openbao-0 -- bao status

  • Verify

    • Open https://vault.lolwtf.ca/ui/ and authenticate with the initial root token only long enough to establish the intended administrator and policies.

    • Confirm a pod restart auto-unseals through GCP KMS before storing production material.

    • Create required auth methods, mounts, policies, audit devices, and the fresh PKI through a reviewed follow-up change.

  • Rollback

    • Before new production data is written, restore the previous HelmRelease chart and GCP KMS/storage configuration from Git, then reconcile Flux.

    • Do not remove the old Vault GCS bucket or KMS key until OpenBao has been verified for the agreed retention window.

Linked references 3

Runbooks/Adopt Folly Monitoring CRDs

Use this before wiring folly's monitoring Flux Kustomization to a monitoring-crds dependency. It is a one-time, hand-run step against the live folly cluster — one of the few kinds this repo carves out an exception for, because Helm's ownership convention has no git-declared path: Helm decides whether to adopt a pre-existing object by reading labels and annotations off the live object, not off anything a Kustomization can express. Runbooks/OpenBao Bootstrap is the same shape of exception, for the same reason — a one-time bootstrap action git cannot express, done once and never repeated by drift-correcting machinery.

Architecture/Secrets and PKI

Bootstrapping (init, unseal verification, first policies) is a runbook, not architecture: Runbooks/OpenBao Bootstrap.

Runbooks

Runbooks/OpenBao Bootstrap — initialize and verify the folly OpenBao instance

Edit this page on GitHub