Decommission a cluster · 0.5.x

Deleting an OpenBaoCluster removes its operator-managed compute and supporting resources. Choose what happens to the local data path before you delete the custom resource.

Choose the deletion policy

Policy	PVCs	Generated unseal and root-token Secrets	External snapshots
`Retain` (default)	Retained	Orphaned from the cluster and retained when present	Retained
`DeletePVCs`	Operator-owned PVCs are deleted	Deleted with other owned resources	Retained
`DeleteAll`	Operator-owned PVCs are deleted	Deleted with other owned resources	Retained in the current implementation

DeletePVCs and DeleteAll remove only PVCs that have OpenBao ownership proof. A label match alone is not enough. PVCs referenced as an existing ACME cache or existing audit-file claim remain outside this cleanup.

DeleteAll does not currently delete S3, GCS, or Azure objects. Apply the storage system’s retention or deletion process separately.

Set the policy

Set the policy before issuing the delete:

configure

Retain the recovery material

spec:
  deletionPolicy: Retain

Use DeletePVCs only for an intentional destructive teardown:

apply

Select PVC deletion

kubectl -n <namespace> patch openbaocluster <name> --type merge -p '{
  "spec": {
    "deletionPolicy": "DeletePVCs"
  }
}'

Delete and verify

apply

Delete the cluster

kubectl -n <namespace> delete openbaocluster <name>

The finalizer applies the policy before Kubernetes garbage collection removes owned resources.

verify

Inspect remaining recovery material

kubectl -n <namespace> get pvc -l openbao.org/cluster=<name>
kubectl -n <namespace> get secret -l openbao.org/cluster=<name>
kubectl -n <namespace> get jobs -l openbao.org/cluster=<name>

With Retain, the Raft PVCs and any generated <cluster>-unseal-key and <cluster>-root-token Secrets are expected to remain. Protect them as sensitive recovery material. With a destructive policy, independently confirm the intended PVCs are gone and decide what to do with external snapshots.