Format:
Export:

Architecture & setup diagrams

OPENBAO HA — 3-NODE RAFT DEPLOYMENTcert-managerCA Issuer (self-signed / own CA)openbao-server-tlsinjector-tls🖥️ Workstationbao CLI · jqopenbao-init.json 🔐unseal keys + root tokenhttps:// (Route)port-forward :8200Namespace: openbaoRoute: openbaoTLS: reencrypt · destinationCACertService: openbaoClusterIP · 8200 (https)Agent injector ×2mutating webhook (sidecars)to active nodeopenbao-0Raft leader · HA activelistener :8200=0PVC data-openbao-01/1 Ready when unsealedopenbao-1follower · standbyretry_join → https://…-0PVC data-openbao-1openbao-2follower · standbyretry_join → https://…-0PVC data-openbao-2Raft replication · quorum 2 of 3openbao-internal (headless Service)⚠ Sealed pods stay 0/1 Ready — expected until init + unseal (PRE-06 / PRE-07)Readiness probe passes only after the seal is openedactive / OpenBaoRaft / Servicecert-manager TLSinjectorstorageRoute / secrets to protect

TC-OPENBAO-OCP-001 / TC-OPENBAO-HA-001: Route termination, listener TLS, Raft-over-HTTPS and injector certs — one picture for the Helm values that change them. See also PRE-04PRE-08.

Search test plan

Type at least 2 characters to search

Keyboard shortcuts

P
Go to prerequisites
T
Go to test cases
G
Go to glossary
D
Go to diagrams
J
Next card
K
Previous card
Enter
Open / close focused card
/
Open search
CtrlK
Open search modal
?
Show shortcuts
Esc
Close panel / blur search