Skip to content

OpenBaoCluster

OpenBaoCluster is the primary Custom Resource Definition (CRD) that declaratively defines a production-ready OpenBao cluster on Kubernetes.

It acts as a high-level abstraction over complex stateful infrastructure, managing the entire lifecycle of the cluster.

Capabilities

  • Secure Defaults

    Automatic TLS certificate management

    Secure-by-default configurations

    Security Profiles for hardening

  • infrastructure

    Managed StatefulSets and Services

    Configurable Storage and PVCs

    Automated resizing (Vertical Scaling)

  • Day 2 Operations

    Automated Upgrades (Rolling & Blue/Green)

    Automated Backups to S3/GCS/Azure

    Breakdown/Recovery automation

GitOps Architecture

The Operator follows a strict GitOps contract. Your Git repository is the source of truth for the spec (Desired State), while the Operator reports the status (Observed State).

flowchart LR
    Git["fa:fa-code-branch Git (ArgoCD/Flux)"] -->|Sync| Spec["OpenBaoCluster.spec\n(Desired State)"]
    Spec -->|Reconcile| Controller["fa:fa-gears Operator Controller"]

    subgraph Cluster ["Kubernetes Cluster"]
        Controller -->|Manage| Infra["StatefulSet\nServices\nConfigMaps\nSecrets"]
        Infra -.->|Report| Status["OpenBaoCluster.status\n(Observed State)"]
    end

    classDef write fill:transparent,stroke:#22c55e,stroke-width:2px,color:#fff;
    classDef read fill:transparent,stroke:#60a5fa,stroke-width:2px,color:#fff;
    classDef git fill:transparent,stroke:#f472b6,stroke-width:2px,color:#fff;

    class Spec read;
    class Status,Infra write;
    class Git git;

Configuration Examples

Start small for local development or testing.

apiVersion: openbao.org/v1alpha1
kind: OpenBaoCluster
metadata:
  name: dev-cluster
  namespace: dev
spec:
  version: "2.0.0"
  replicas: 1
  description: "Local dev cluster"

A standard 3-node HA cluster with TLS and storage.

apiVersion: openbao.org/v1alpha1
kind: OpenBaoCluster
metadata:
  name: prod-cluster
  namespace: security
spec:
  version: "2.0.0"
  replicas: 3
  description: "Production HA Cluster"

  resources:
    requests:
      memory: "1Gi"
      cpu: "500m"

  storage:
    size: "10Gi"
    storageClass: "gp3"

  tls:
    enabled: true

Next Steps