Initialise OpenBao

Goal: OpenBao unsealed and auto-unsealing, with a policy, a role and seeded secrets for every app. About 10 minutes.

Procedure

1. Wait for the OpenBao pod to run. It stays sealed.

   kubectl get pods -n openbao -w

2. Initialise and unseal. The recipe revokes the init root token at once and writes only the unseal key, to ~/openbao-unseal-key (mode 600).

   just openbao-init

3. Set OPENBAO_UNSEAL_KEY in SOPS to the contents of that file.

   just sops-view secrets/bootstrap.sops.yaml

4. Push the real key into the cluster and restart the pod. The StatefulSet uses OnDelete, so a rollout does nothing; the unseal sidecar reads the new Secret on start.

   just create-secrets
   kubectl delete pod -n openbao openbao-0
   rm ~/openbao-unseal-key

5. Enable Kubernetes auth and KV v2, write a read-only policy and role per app, and seed every missing key.

   just openbao-setup

openbao-setup is idempotent: it rewrites auth, policies and roles, but never overwrites a key that exists. Grafana’s OAUTH_CLIENT_SECRET comes from GRAFANA_OAUTH_CLIENT_SECRET in SOPS; everything else is random. NETBIRD_SETUP_KEY starts as a placeholder so the CSI mount succeeds, and gets its real value in Phase 6.

openbao-init refuses to run twice

It stops if ~/openbao-unseal-key exists. Move the key into SOPS and delete the file first.

openbao-setup stops on a missing SOPS key

It exits if GRAFANA_OAUTH_CLIENT_SECRET is not in the SOPS file. Add it (see Phase 0) and re-run.

Check

kubectl exec -n openbao openbao-0 -c openbao -- bao status | grep Sealed
just openbao-sa-get grafana grafana grafana secret/grafana ADMIN_PASSWORD >/dev/null && echo policy-ok
kubectl get applications -n argocd

Sealed false, then policy-ok. Apps turn Healthy as their CSI volumes mount.

Details: Secrets, OpenBao.