Configure storage

Choose the voter StorageClass and initial capacity before creating the OpenBaoCluster. The storage class cannot be changed afterward, and capacity can only grow.

Configure voter storage

spec.storage.size is required. storageClassName is optional, but omitting it delegates the decision to the default StorageClass at PVC creation time.

spec:
  storage:
    size: "50Gi"
    storageClassName: fast-encrypted

The operator creates one ReadWriteOnce data PVC for each voter. Before creating the cluster, verify that the chosen StorageClass provides the required IOPS, latency, topology, encryption, expansion, backup, and failure-domain behavior.

The user applying an explicit StorageClass must have the delegated use permission on that StorageClass. This prevents a tenant from selecting platform storage without authorization.

Understand PVC retention

The voter StatefulSet uses these retention policies:

• deleting the StatefulSet retains its data PVCs;
• scaling the StatefulSet down deletes PVCs for removed replicas.

Do not treat a replica reduction as a reversible scheduling change. Confirm Raft membership, backup state, and the data retention consequence before scaling down.

Expand data PVCs

Increase spec.storage.size only after confirming that the StorageClass and CSI driver support expansion. The operator patches each managed PVC request upward. It rejects a smaller requested size.

kubectl -n <namespace> patch openbaocluster <name> --type merge \
  -p '{"spec":{"storage":{"size":"100Gi"}}}'

Some CSI drivers finish filesystem expansion only after the mounted Pod restarts. When a PVC reports FileSystemResizePending, enable maintenance mode so the operator can perform a controlled restart:

kubectl -n <namespace> patch openbaocluster <name> --type merge \
  -p '{"spec":{"maintenance":{"enabled":true}}}'

If maintenance is disabled, the operator reports StorageRestartRequired. Disable maintenance again after the PVCs and Pods converge.

Configure read-replica storage and resources

Read replicas inherit voter storage unless spec.readReplicas.storage overrides it. A read-replica size cannot be smaller than the voter size.

The current API exposes CPU and memory requests and limits only for read replicas:

spec:
  readReplicas:
    replicas: 2
    template:
      resources:
        requests:
          cpu: 500m
          memory: 1Gi
        limits:
          cpu: "1"
          memory: 2Gi
    storage:
      size: 100Gi
      storageClassName: fast-encrypted

Do not copy manifests that use top-level spec.resources; strict CRD decoding rejects that field.

Configure audit file storage

Use spec.auditFileStorage when file audit devices need a shared collector handoff. It is separate from the Raft data path and is not the authoritative retention archive.

Let the operator create the audit PVC

spec:
  auditFileStorage:
    mode: ManagedPVC
    size: "20Gi"
    storageClassName: rwx-encrypted
  audit:
    - type: file
      path: file
      fileOptions:
        filePath: /openbao/audit/audit.jsonl

Managed mode creates one dedicated, sensitive-labeled ReadWriteMany PVC. Size it for collector lag and replay, then ship records to an external log system or immutable archive for retention and search.

Mount a platform-owned audit PVC

spec:
  auditFileStorage:
    mode: ExistingPVC
    existingClaimName: openbao-audit
    mountPath: /openbao/audit

The claim must exist in the same namespace, be Bound, and include ReadWriteMany. The applying user needs delegated use permission on the PVC. size and storageClassName are valid only in ManagedPVC mode.

Each OpenBao Pod writes through the same mount path but uses its own pod-name subdirectory on the shared claim. A collector can mount the claim read-only and read those per-Pod files.

On standard Kubernetes, generated Pods default to UID 100, GID 1000, and fsGroup: 1000. OpenShift leaves those IDs unset for Security Context Constraints, and spec.securityContext can override them. Verify writable ownership against the rendered Pod security context and the CSI driver’s fsGroup behavior.

Verify storage

1. Inspect every cluster-owned PVC. The cluster label also selects audit and ACME cache claims, not only data PVCs.

   inspect

   Inspect cluster PVCs

   Copy

   kubectl -n <namespace> get pvc \
        -l openbao.org/cluster=<name> \
        -o wide

2. Inspect PVC capacity and resize conditions.

   verify

   Check PVC capacity and conditions

   Copy

   kubectl -n <namespace> get pvc <pvc-name> \
        -o jsonpath='{.spec.resources.requests.storage}{"\t"}{.status.capacity.storage}{"\n"}{range .status.conditions[*]}{.type}={.status}{"\t"}{.message}{"\n"}{end}'

3. Inspect the operator’s storage conditions.

   verify

   Check cluster storage conditions

   Copy

   kubectl -n <namespace> get openbaocluster <name> \
        -o jsonpath='{range .status.conditions[*]}{.type}={.status}{"\t"}{.reason}{"\t"}{.message}{"\n"}{end}'

StorageConfigured=True confirms the effective voter StorageClass is resolved and consistent. It does not prove requested capacity or filesystem expansion completed. AuditFileStorageReady=True confirms the audit claim is Bound, RWX, and mounted by the generated workload. A configured audit claim that is not ready blocks Hardened ProductionReady; it does not independently determine Pod availability.

Continue with server runtime configuration.