Use this guide to install the operator with an explicit ownership model, create the first cluster, and identify the controls required before production.
Before you begin
You need:
- a Kubernetes cluster that meets the compatibility requirements;
- cluster-admin access to install CRDs, RBAC, and admission policies;
kubectlconfigured for the cluster;- Helm with OCI registry support for the recommended multi-tenant install;
- ownership decisions for the operator namespace, target namespace, and OpenBao administration.
Choose the outcome
| Outcome | Use this route | Exit condition |
|---|---|---|
| Evaluate the operator | Install in multi-tenant mode and create a disposable Development cluster | The tenant handoff exists and the cluster reports Available=True |
| Prepare production | Choose the deployment model, then complete the Hardened configuration and operational prerequisites | Human access, external trust, storage, backup, restore, monitoring, and upgrade ownership are tested |
| Operate one dedicated namespace | Install in single-tenant mode with Helm or the maintained Kustomize overlay | Watched namespace, target RoleBinding, controller identity, and namespace all match |
Choose the tenancy path
Start with Choose a deployment model to decide tenancy, security profile, bootstrap, TLS, and installation ownership.
For multi-tenant operation:
- Install the operator and verify the controller, Provisioner, CRDs, admission policies, and identities.
- Onboard a namespace through
OpenBaoTenantand verify the tenant RoleBinding. - Create the first cluster.
- Prepare for production operations.
For one dedicated namespace:
- Install in single-tenant mode and verify the watched namespace and controller identity.
- Skip
OpenBaoTenant; the Provisioner is not part of this model. - Create the first cluster in the watched namespace.
- Prepare for production operations.
Review supporting decisions
- Single-tenant mode explains the controller-only Helm and Kustomize paths and their namespace contract.
- Operator authentication maps ServiceAccounts, projected JWTs, OpenBao roles, and human bootstrap access.
- Operator authorization records the distinct controller, backup, restore, and upgrade policies.
- Compatibility separates chart constraints from the versions exercised by current CI.
Finish Get Started with
- a repeatable, version-pinned operator installation;
- an explicit multi-tenant or single-tenant namespace boundary;
- a verified first-cluster status and workload state;
- separate operator and human authentication paths;
- named owners and tested procedures for backup, restore, exposure, monitoring, and upgrade.