Single-node raft OpenBao (5Gi ceph-block, UI at openbao.k.renner.uno, internal-only ingress) and ESO 2.x. No ClusterSecretStore yet — it can only turn Ready after manual init/unseal, and committing it now would freeze the infrastructure-crds wait gate (2026-07-13 incident shape). Full phased plan incl. per-file checklist and DR runbook in kubernetes/MIGRATION-sops-openbao.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6