You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/modules/ROOT/pages/adr/0049-managed-openbao.adoc
+9-1Lines changed: 9 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -221,8 +221,10 @@ data:
221
221
ROOT_TOKEN: <base64-encoded-root-token>
222
222
```
223
223
224
+
pass:[<!-- vale off -->]
224
225
**Auto-unseal**
225
226
227
+
226
228
Auto unseal allows OpenBao to unseal automatically without manual intervention using an external key management system. This is crucial for automated recovery and reduces operational burden.
227
229
228
230
By default OpenBao instances will be configured to use a central, internal VSHN managed Vault or OpenBao to auto-unseal.
@@ -242,6 +244,8 @@ If no auto-unseal provider is configured, manual unsealing using the unseal keys
242
244
243
245
Example AWS KMS auto-unseal secret:
244
246
247
+
pass:[<!-- vale on -->]
248
+
245
249
```yaml
246
250
apiVersion: v1
247
251
kind: Secret
@@ -288,12 +292,13 @@ Key Components::
288
292
4. **Monitoring**: Custom SLI exporter and Prometheus integration
289
293
290
294
Security Model::
291
-
295
+
pass:[<!-- vale off -->]
292
296
- TLS encryption for all communications
293
297
- RBAC policies managed through OpenBao
294
298
- Audit logging to persistent storage
295
299
- Auto-unseal configuration for OpenBao bootstrap
296
300
301
+
pass:[<!-- vale on -->]
297
302
== Consequences
298
303
299
304
Positive::
@@ -318,7 +323,10 @@ Operational Impact::
318
323
- Need for OpenBao and Raft consensus expertise in operations team
319
324
- Integration testing with existing AppCat services
0 commit comments