OpenBao ObservabilitySearch GitHub

Reference architecture

OpenBao Observability

Use this site to understand OpenBao observability, run the local validation profile, adopt generated artifacts, read dashboards, and respond to alerts.

The architecture starts from verified OpenBao behavior and source contracts, then publishes a tested Prometheus, Loki, Grafana, and Grafana Alloy profile that you can adapt to your own monitoring and logging platform.

Read architecture Run locally
Grafana dashboard collage showing OpenBao overview, HA/Raft, audit, and feature-specific observability panels.

Workflow

Read in the order you operate

  1. 01

    Understand the architecture

    Start with the signal layers, trust boundaries, and portable decisions that stay stable across monitoring and logging platforms.

    Overview Signal model Signal types
  2. 02

    Run the local profile

    Use Docker Compose to inspect generated dashboards, alerts, logs, and fixture scenarios against a local OpenBao HA cluster.

    Docker Compose Profile Overview dashboard
  3. 03

    Adopt the signals

    Map metrics, logs, audit logs, labels, dashboards, alerts, and runbooks into your own observability platform.

    Adoption Secure scrape Label strategy
  4. 04

    Read the dashboards

    Use dashboard docs to understand what each generated panel asks, what data it needs, and where to drill down next.

    HA/Raft Audit investigation Secret engines
  5. 05

    Respond to alerts

    Follow runbooks for scrape failures, sealed nodes, HA/Raft problems, audit failures, security detections, and SLO burn.

    Scrape failing Raft health Security detections

Sections

Documentation map

Architecture Portable OpenBao observability architecture, adoption guidance, and platform responsibilities. Concepts Deep explanations for OpenBao metrics, logs, audit logs, HA/Raft behavior, token and lease signals, and label safety. Profiles Implementation profiles for Prometheus, Loki, Grafana, Alloy, Docker Compose, Kubernetes, and the OpenBao Operator. Metrics Metric behavior, scrape profiles, compatibility, recording rules, HA/Raft metrics, and token and lease metrics. Logging Operational logs, audit logs, Loki label strategy, retention, and access-control guidance. Audit Audit devices, audit logs, canary checks, archive health, and security-record handling. Dashboards Generated Grafana dashboards for overview, HA/Raft, audit, logs, identity, leases, secret engines, runtime, Kubernetes, and SLOs. Runbooks Operational, audit, security, runtime, Kubernetes, and SLO runbooks linked from generated alerts. Contracts Reference material for metric prefixes, recording rules, and source contracts.

Reference

Signals, safety, and operations

Metrics

Metric behavior, scrape profiles, compatibility, recording rules, and derived OpenBao signals.

Audit

Audit devices, audit logs, canary checks, archive health, and security-record handling.

Operator profile

Companion guidance for using this reference architecture with operator-managed OpenBao clusters.