feat(openbao): nightly raft snapshots + velero offsite shipping #177

2026-07-14T00:04:34Z

claude-bot commented

2026-07-14 00:04:34 +00:00

Closes the last DR gap from kubernetes/MIGRATION-sops-openbao.md.

CronJob openbao-raft-snapshot (openbao ns, 03:00 Europe/Berlin): logs in via kubernetes auth (new SA openbao-snapshot → role → policy raft-snapshot, read on sys/storage/raft/snapshot only — already configured in OpenBao, no token stored anywhere), saves bao operator raft snapshot to a dedicated 5Gi PVC, keeps the newest 7. Same image as the server (quay.io/openbao/openbao:2.5.5), uid 100/fsGroup 1000 to match.
Velero Schedule openbao-daily (06:15, last free stagger slot): ships only the snapshot PVC offsite via the app.kubernetes.io/component: raft-snapshots label — the live raft data PVC is deliberately excluded (crash-consistent db files; the .snap is the supported restore artifact). 30 d retention like the other schedules.
Failure = signal: a sealed OpenBao (forgotten unseal after pod restart) fails the login step and the Job goes Failed — that's the alarm that backups stopped.
Migration doc DR section updated; the remaining DR item is one tested restore before phase 4 — I'd run that against a scratch namespace after the first nightly snapshot exists.

After merge I'll trigger one manual Job run to prove the pipeline end-to-end rather than waiting for 03:00.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

Closes the last DR gap from kubernetes/MIGRATION-sops-openbao.md. - **CronJob `openbao-raft-snapshot`** (openbao ns, 03:00 Europe/Berlin): logs in via kubernetes auth (new SA `openbao-snapshot` → role → policy `raft-snapshot`, read on `sys/storage/raft/snapshot` only — **already configured in OpenBao**, no token stored anywhere), saves `bao operator raft snapshot` to a dedicated 5Gi PVC, keeps the newest 7. Same image as the server (`quay.io/openbao/openbao:2.5.5`), uid 100/fsGroup 1000 to match. - **Velero Schedule `openbao-daily`** (06:15, last free stagger slot): ships **only the snapshot PVC** offsite via the `app.kubernetes.io/component: raft-snapshots` label — the live raft data PVC is deliberately excluded (crash-consistent db files; the .snap is the supported restore artifact). 30 d retention like the other schedules. - **Failure = signal:** a sealed OpenBao (forgotten unseal after pod restart) fails the login step and the Job goes Failed — that's the alarm that backups stopped. - Migration doc DR section updated; the remaining DR item is **one tested restore before phase 4** — I'd run that against a scratch namespace after the first nightly snapshot exists. After merge I'll trigger one manual Job run to prove the pipeline end-to-end rather than waiting for 03:00. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

claude-bot added 1 commit 2026-07-14 00:04:34 +00:00

feat(openbao): nightly raft-snapshot CronJob + velero offsite schedule 6afff75b6e

bao operator raft snapshot save nightly at 03:00 to a dedicated PVC
(keep 7), authenticated via a new k8s-auth role openbao-snapshot ->
policy raft-snapshot (read on sys/storage/raft/snapshot only; applied
2026-07-14). Velero openbao-daily (06:15) ships ONLY the snapshot PVC
offsite via label selector — the live raft data PVC stays unbacked
(crash-consistent files; the .snap is the restore artifact). A failed
Job doubles as the sealed-after-restart alarm.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

k.renner merged commit cb3894b2f4 into master

2026-07-14 00:06:55 +00:00

k.renner referenced this issue from a commit

2026-07-14 00:06:55 +00:00

Merge pull request 'feat(openbao): nightly raft snapshots + velero offsite shipping' (#177) from openbao-snapshots into master

claude-bot referenced this pull request

2026-07-14 00:08:37 +00:00

fix(openbao): restricted-PodSecurity compliance for snapshot CronJob #178

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#177