Glossary & concepts

Concepts

Short explanations of concepts used across the test plans — networking, storage, secrets management, and more — for anyone who does not work with them every day.

macvtap (NOT supported) vs. OVN-K localnet (official path)

macvtap gives a VM its own MAC — but is NOT officially supported in OpenShift Virtualization. The correct approach is OVN-K localnet.

WaitForFirstConsumer (StorageClass binding mode)

A PVC stays deliberately 'Pending' until a pod/VM actually uses it — not an error!

NodeNetworkConfigurationPolicy (NNCP)

Declarative node network configuration via the Kubernetes API — instead of manual nmcli commands.

OVN-Kubernetes & br-ex

OpenShift's default network plugin uses an OVS bridge (br-ex) that takes over the physical NIC.

HCP: does every hosted cluster need its own public IP?

No — only the API server (with the KubeVirt/on-prem provider) needs a dedicated IP or dedicated port. OAuthServer, Konnectivity, and Ignition already share the management cluster's existing Ingress route today.

Sealed vs unsealed — why pods stay 0/1 Ready

A sealed OpenBao holds only encrypted data and refuses almost every request — the pod runs but is not Ready. Unsealing reconstructs the barrier key.

OpenBao encrypts everything at rest behind a 'barrier'. On start, the barrier key is not in memory: the instance is sealed. With Shamir, the key is split into shares (e.g. 5) and a threshold (e.g. 3) must be entered — that is why bao operator unseal is run three times with different keys. With auto-unseal (transit or a cloud KMS), an external system decrypts the barrier key on start and no human is involved; the Shamir shares then become recovery keys. A sealed pod is healthy from Kubernetes' point of view but fails the readiness probe — 0/1 Ready is expected, not an error.

✓ ADVANTAGES

Shamir: no external dependency — works in any air-gapped lab
Auto-unseal: pods survive restarts and node reboots without a human entering keys
Threshold scheme means no single person can open the barrier alone

⚠ LIMITATIONS

Shamir: every pod restart needs manual unsealing (3 keys, per pod)
Transit: the transit instance itself must be up and unsealed — chicken-and-egg if it runs on the same cluster
KMS: cloud reachability and IAM become part of your availability story

COMPARISON

Shamir (manual): Init generates key shares; humans unseal each pod. Used in PRE-06/PRE-07 and TC-OPENBAO-UNSEAL-001.

Transit auto-unseal: A second OpenBao (PRE-09) decrypts the barrier key via its transit engine. TC-OPENBAO-UNSEAL-002 migrates a live cluster to it.

AWS KMS auto-unseal: Cloud KMS key opens the barrier; init uses recovery shares instead of key shares. Used in TC-OPENBAO-UNSEAL-003 and the DR restore (TC-OPENBAO-BK-002).

KV v2 — versions, soft delete, and check-and-set (CAS)

KV v2 keeps a version history per secret and can require a version number on every write — a write is a whole new version, not a field update.

Kubernetes auth method — SA token in, OpenBao token out

Pods authenticate with their projected ServiceAccount JWT; OpenBao validates it against the kube-apiserver and returns a short-lived token carrying the role's policies.

OpenBao vs Vault — why /vault/ still appears everywhere

OpenBao is the Linux Foundation fork of HashiCorp Vault and keeps API and tooling compatibility — so UI routes, sidecar paths, and third-party integrations still say 'vault'.

Raft integrated storage — leader, quorum, snapshots

OpenBao stores data itself and replicates it with the Raft consensus protocol — no external database, but quorum rules apply.

📚 Glossary & concepts

Glossary & concepts