These runbooks assume the provider runs on every control-plane node and the
API server encrypts through it. Before you change rotation, recovery, or
upgrade state, confirm doctor passes on every node:
bao-kms-provider doctor \
--config /etc/openbao-kms/config.yaml \
--encryption-config /etc/kubernetes/openbao-kms/encryption-config.yamlPages in this section
Rotate the Transit key version, wait for every provider to promote it, rewrite existing resources, and retire old versions only when backups no longer need them.
→ Operate · Recovery Disaster recoveryBack up OpenBao, etcd, and provider state as compatible sets, and restore the KMS path before the API server; lost Transit key material without a backup cannot be recovered.
→ Operate · Change management UpgradeUpgrade the provider one control-plane node at a time, confirm each node rejoins with the same key, and roll back only when the older release can read every stored format.
→ Operate · Diagnosis TroubleshootingFind the failing layer first, then apply the recovery for that symptom: socket, OpenBao, auth, Transit key, key_id and AAD validation, fallback, or static pod.
→