OpenBao Operator separates fast workload repair from long-running operations and destructive recovery. The architecture is organized around the contracts that must survive retries, controller restarts, and partial failure.
Read by concern
| Concern | Reference |
|---|---|
| Package direction, controller roles, status ownership, and cross-cutting safety rules | Invariants and boundaries |
| Certificate readiness, configuration, workload resources, initialization, and scale-out | Workload lifecycle |
| Backup, restore, upgrade, operation locks, and resumable status | Operations |
| Tenant namespace RBAC, Secret allowlists, quotas, and controller handoff | Tenant provisioning |
Lifecycle at a glance
- The provisioner establishes a tenant namespace boundary when multi-tenancy is enabled.
- The workload path prepares TLS and infrastructure, starts one OpenBao pod, initializes the cluster, and then scales it.
- Workload reconciliation keeps generated resources converged while the status controller observes health.
- The AdminOps path coordinates backup and upgrade. A dedicated restore path handles destructive recovery.
- Backup, restore, and upgrade use one persisted operation lock so disruptive work does not overlap.