Skip to content

Basic Cluster Creation

This guide walks you through creating your first OpenBaoCluster. Choose the path that matches your use case.

Prerequisites

  • OpenBao Operator: Installed and running (see Installation)
  • Storage Class: Default storage class configured in the cluster

Choose Your Path

For local development and testing. Not suitable for production.

apiVersion: openbao.org/v1alpha1
kind: OpenBaoCluster
metadata:
  name: dev-cluster
  namespace: default
spec:
  version: "2.4.4"
  image: "openbao/openbao:2.4.4"
  replicas: 3
  profile: Development
  tls:
    enabled: true
    mode: OperatorManaged
    rotationPeriod: "720h"
  storage:
    size: "10Gi"

Development Profile

The Development profile uses static auto-unseal and stores sensitive material in Kubernetes Secrets. This is convenient for testing but insecure for production use.

For production deployments with hardened security.

apiVersion: openbao.org/v1alpha1
kind: OpenBaoCluster
metadata:
  name: prod-cluster
  namespace: openbao
spec:
  version: "2.4.4"
  image: "openbao/openbao:2.4.4"
  replicas: 3
  profile: Hardened
  tls:
    enabled: true
    mode: External
  storage:
    size: "50Gi"
  selfInit:
    enabled: true
  unseal:
    type: awskms
    awskms:
      region: us-east-1
      kmsKeyID: alias/openbao-unseal

Production Checklist

Before deploying to production, complete the Production Checklist to ensure proper security configuration.

Apply the Configuration

kubectl apply -f cluster.yaml

Verify Deployment

Check the cluster status:

kubectl get openbaocluster <name> -n <namespace>

Watch pods come up:

kubectl get pods -l openbao.org/cluster=<name> -n <namespace> -w

Check Status Conditions

kubectl describe openbaocluster <name> -n <namespace>

Look for:

  • status.phase — Current lifecycle phase
  • status.readyReplicas — Number of ready replicas
  • status.initialized — true after cluster initialization
  • status.conditions:
  • Available — Cluster is serving requests
  • TLSReady — TLS certificates are valid
  • ProductionReady — Security requirements met (Hardened only)
  • Degraded — Issues detected

Next Steps