Storage and workload sizing

The operator renders the workload, but storage class and capacity choices still belong to the platform baseline. Use this page to set resource requests, understand PVC growth behavior, and make storage decisions explicit.

Decision matrix

What the operator manages for an OpenBaoCluster

What the operator manages for an OpenBaoCluster.

Surface	What it does	What still belongs to you
StatefulSet and Pod template	Renders the OpenBao Pods, init container, probes, mounts, labels, and rollout behavior.	Choose resource requests, limits, and the cluster shape that the generated Pods should follow.
Services, ConfigMaps, and Secrets	Creates the workload-facing Service surfaces plus the rendered configuration and runtime Secrets required by the chosen profile.	Own the service-boundary decision, TLS ownership model, and any external secrets or certificate material that are not operator-managed.
Data PVCs	Creates one PVC per replica from the StatefulSet claim template and patches existing PVC size when you increase storage.	Choose the correct StorageClass up front and verify that the underlying CSI driver supports the expansion behavior you expect.
Audit file storage PVC	Creates or mounts one RWX PVC when spec.auditFileStorage is configured.	Choose storage that supports multi-node mounts, encryption at rest, and writable ownership for the OpenBao Pod security context.
Default NetworkPolicy	Applies the operator-managed baseline traffic rules for Pods in the cluster.	Add any extra ingress or egress rules your environment requires and validate them against backup, restore, and edge traffic.

Diagram

Managed resource footprint

The OpenBaoCluster spec drives a rendered workload. The operator owns the generated Kubernetes resources, but the platform choices behind storage, capacity, and external dependencies still need to be deliberate.

Set the baseline explicitly

Configure

Set storage and workload requests up front

yaml

apiVersion: openbao.org/v1alpha1
kind: OpenBaoCluster
metadata:
name: prod-cluster
namespace: openbao
spec:
version: "2.5.0"
profile: Hardened
replicas: 3
resources:
  requests:
    cpu: "500m"
    memory: "1Gi"
  limits:
    cpu: "1000m"
    memory: "2Gi"
storage:
  size: "50Gi"
  storageClassName: "fast-ssd"

Set explicit requests and an explicit storageClassName in production. Defaults are acceptable for evaluation, but they provide less predictable long-term storage behavior.

Reference table

Storage rules that become expensive later

Storage rules that become expensive later.

Choice	Operator behavior	Why it matters
spec.storage.storageClassName	The effective storage class becomes immutable after the first PVCs are created.	Pick it before first reconcile if you care about IOPS, topology, encryption, or cost. Do not plan on fixing it in place later.
spec.storage.size	The operator supports expansion only. Decreasing size is rejected.	Plan growth, not shrinkage. If the first size is too small, you can grow it, but you cannot safely reverse it through the API.
Default StorageClass	If you omit storageClassName, Kubernetes uses the cluster default when PVCs are created.	That may be acceptable in development, but in production it is better to make the storage path explicit and auditable.
Filesystem expansion	Some CSI drivers finish expansion only after a restart. The operator surfaces that and can use a controlled restart path when maintenance is enabled.	A size increase is not complete until the PVC and cluster conditions confirm it.

Size audit file storage

spec.auditFileStorage is separate from the Raft data path. Use it only when file audit devices need a filesystem handoff for a collector.

Configure

Create a managed RWX audit PVC

yaml

apiVersion: openbao.org/v1alpha1
kind: OpenBaoCluster
metadata:
name: prod-cluster
spec:
auditFileStorage:
  mode: ManagedPVC
  size: "20Gi"
  storageClassName: "rwx-encrypted"
audit:
  - type: file
    path: file
    fileOptions:
      file_path: "/openbao/audit/audit.jsonl"
      format: "json"

Set the size for expected collector lag, replay needs, and failure recovery. Long-term retention belongs in the downstream log or archive system.

Reference table

Audit storage requirements

Audit storage requirements.

Requirement	What to verify	Operational note
ReadWriteMany	The PVC must include ReadWriteMany and reach Bound.	AuditFileStorageReady=False reports missing, pending, or non-RWX claims before the workload can be considered ready.
Writable ownership	The mounted path must be writable by the OpenBao runtime user or group.	On standard Kubernetes the Pods run as UID 100 and GID 1000 with fsGroup: 1000. Verify that the CSI driver honors that, or pre-provision ownership for existing claims.
Encryption and node placement	The backing storage must match the sensitivity of audit records.	Audit records can contain request metadata. Keep storage encryption, node access, and platform-admin access in the security review.
Capacity and cleanup	The PVC must absorb collector outages without filling the filesystem.	Define alerting and cleanup outside the operator. The operator does not rotate, prune, or archive audit files.

Inspect the rendered storage state

Inspect

Inspect the data PVCs for a cluster

bash

kubectl get pvc -n <namespace> -l openbao.org/cluster=<name>

Check the requested size, bound StorageClass, and whether any PVC reports FileSystemResizePending.

Verify

Check audit storage readiness

bash

kubectl get openbaocluster <name> -n <namespace> \
-o jsonpath='{range .status.conditions[?(@.type=="AuditFileStorageReady")]}{.status}{"\t"}{.reason}{"\t"}{.message}{"\n"}{end}'

kubectl get pvc -n <namespace> <audit-pvc-name> \
-o jsonpath='{.status.phase}{"\t"}{.spec.accessModes}{"\n"}'

Use the condition for the operator view and the PVC command for the underlying Kubernetes storage state.

Verify

Check the cluster storage condition

bash

kubectl get openbaocluster <name> -n <namespace> \
-o jsonpath='{range .status.conditions[*]}{.type}={.status}{"\t"}{.reason}{"\n"}{end}'

A healthy cluster should eventually report StorageConfigured=True. If it does not, fix the storage-path mismatch before continuing with upgrades or backups.

Controlled restarts still matter after a PVC expansion

If your CSI driver requires a restart to finish filesystem resize, use the maintenance workflow instead of bouncing Pods ad hoc. The operator can only take the controlled restart path when spec.maintenance.enabled=true.

Continue platform readiness

ObservabilityWire metrics, dashboards, and alerting before the first storage or rollout problem becomes a blind incident.Air-gapped and private registriesUse the disconnected-environment guide when image sources, pull secrets, or mirrored helper images are part of the platform contract.Configure backupsConfigure backups against the storage path the cluster will use in steady state.