Architecture

Operator architecture

Controller boundaries, lifecycle coordination, invariants, and implementation tradeoffs behind OpenBao Operator.

Read the invariantsOpen component design

Use architecture when you need to

• understand the contracts the operator is trying to preserve
• see how controllers, managers, and shared services divide responsibility
• follow a lifecycle flow from tenant onboarding to day 2 operations
• connect internal behavior back to security posture and status semantics

Architecture routes

1. 01

   Operator invariants

   Lifecycle contracts and the assumptions the controller design depends on.

   Open
2. 02

   Component design

   Split-controller control plane, app layer, and manager boundaries.

   Open
3. 03

   Workload managers

   Bootstrap, networking, identity, and StatefulSet ownership on the workload reconcile path.

   Open
4. 04

   Operation lifecycle coordination

   Shared lock, retry, and phase-transition primitives behind backup, restore, and upgrade flows.

   Open
5. 05

   Lifecycle architecture

   Follow the operator from Day 0 provisioning through Day 2 operations and backup-driven recovery.

   Open

Related sections

Open securitySecurity contracts for RBAC, admission, identity, and workload controls.Open referenceStatus conditions, events, and observable contracts.Open OperateUser-facing operating guides for upgrades, backups, and recovery.