Install the operator

Next tracks unreleased behavior on main. Use the edge channel for an executable evaluation install, or build from source when you are developing the operator. Do not treat either path as a stable production contract.

Before you begin

• Confirm that the cluster meets the Next compatibility requirements.
• Use an identity that can create cluster-scoped CRDs, RBAC, and ValidatingAdmissionPolicies.
• Install kubectl. Source deployments also require the repository toolchain and a registry the cluster can pull from.
• Decide the tenancy model. Use the single-tenant procedure for one watched namespace.

Install the latest validated edge build

The edge publisher promotes images and generates manifests from the same successful main commit. Inspect the channel metadata before applying it so you know the exact commit and image digests under evaluation.

1. Set the edge channel URL and inspect its metadata.

   inspect

   Review the current edge build

   Copy

   export EDGE_ROOT=https://dc-tec.github.io/openbao-operator/edge/latest
      curl --fail --silent --show-error "${EDGE_ROOT}/metadata.json"

   Record the sha, generated time, and image digests. Follow the supply-chain verification procedure when the evaluation requires provenance verification.

2. Apply the generated multi-tenant installer.

   apply

   Install the edge manifest

   Copy

   kubectl apply -f "${EDGE_ROOT}/install.yaml"

3. Wait for both multi-tenant controllers.

   verify

   Verify the controller and Provisioner

   Copy

   kubectl -n openbao-operator-system rollout status \
        deployment/openbao-operator-controller --timeout=2m
      kubectl -n openbao-operator-system rollout status \
        deployment/openbao-operator-provisioner --timeout=2m

4. Verify the installed APIs and admission policies.

   verify

   Verify cluster-scoped resources

   Copy

   kubectl get crd \
        openbaoclusters.openbao.org \
        openbaotenants.openbao.org \
        openbaorestores.openbao.org
      kubectl get validatingadmissionpolicies

5. Verify the controller identity.

   inspect

   Inspect the controller identity

   Copy

   kubectl -n openbao-operator-system get serviceaccount \
        openbao-operator-controller
      kubectl -n openbao-operator-system get deployment \
        openbao-operator-controller -o yaml

   Confirm that the Deployment uses the rendered ServiceAccount and projected openbao-token. Continue with operator authentication when you customize the JWT audience or identity.

Deploy from source

Use a source deployment when you need a local change or an exact checkout that has not reached the edge channel.

1. Check out the intended commit and prepare the toolchain.

   configure

   Prepare the source checkout

   Copy

   git clone https://github.com/dc-tec/openbao-operator.git
      cd openbao-operator
      git checkout <commit>
      make bootstrap

2. Build and push an image that the cluster can pull.

   build

   Publish the development image

   Copy

   export IMG=<registry>/openbao-operator:<commit>
      make docker-build docker-push IMG="${IMG}"

   For a local Kind cluster, load the image into every node instead of pushing it, then use the same image reference for deployment.

3. Deploy the generated resources and the selected image.

   apply

   Deploy the source build

   Copy

   make deploy IMG="${IMG}" OPERATOR_VERSION=edge

Render the local Helm contract

Use the checked-out chart when you need to evaluate Helm rendering, including the single-tenant or OpenShift paths. The edge image and operator version keep helper-image selection aligned with the unreleased build.

helm template openbao-operator charts/openbao-operator \
  --namespace openbao-operator-system \
  --include-crds \
  --set image.tag=edge \
  --set operatorVersion=edge

Review the controller and Provisioner ServiceAccounts, RoleBinding subjects, admission-policy identities, projected token audience, images, and namespaces before applying the render.

Refresh an edge installation

The edge channel is mutable. Re-read metadata.json, then apply CRDs before the complete installer when the recorded commit changes.

kubectl apply -f "${EDGE_ROOT}/crds.yaml"
kubectl apply -f "${EDGE_ROOT}/install.yaml"

Re-render custom identities and review OpenBao-side policy changes before refreshing. Self-init does not update existing OpenBao policies.

Remove the source or edge deployment

Use the same generated manifest that installed the operator. Inventory every OpenBaoCluster, OpenBaoTenant, and OpenBaoRestore before deleting CRDs because CR deletion can trigger lifecycle behavior.

kubectl delete -f "${EDGE_ROOT}/install.yaml"

Troubleshoot installation

In multi-tenant mode, continue with namespace onboarding.