Restore OpenBao from a Raft snapshot on a completely new cluster. In this test case we simply use a new namespace. Covers deploying a fresh OpenBao instance, restoring from backup, re-unsealing with the original unseal keys, and verifying that all secrets, policies, and auth configurations are intact.
Prerequisites checklist
Confirm these before running steps:
- TC-OPENBAO-BK-001Full OpenBao Backup Strategy
- Source Secrets in namespace
openbao:openbao-server-tls,aws-kms-creds,injector-tls(copied intoopenbao-drfor this lab) - Original unseal keys from
openbao-init.json(required after restore) - Same Helm values as the source cluster
1Create the DR namespace and copy required Secrets
Pods need TLS (and optional AWS KMS) Secrets before they can start. Copy them from the source namespace openbao:
oc create namespace openbao-dr
for s in openbao-server-tls aws-kms-creds injector-tls; do
oc get secret "$s" -n openbao -o json \
| jq 'del(.metadata.resourceVersion,.metadata.uid,.metadata.creationTimestamp,.metadata.ownerReferences,.metadata.managedFields) | .metadata.namespace="openbao-dr"' \
| oc apply -f -
done2Deploy a fresh OpenBao instance
Separate namespace openbao-dr (created above) is used here
helm install openbao openbao/openbao -n openbao-dr -f values-ha.yaml --set fullnameOverride=openbao-droc exec -it openbao-dr-0 -n openbao-dr -- bao status3Initialise the new instance (temporary — overwritten by restore)
Step 1: Copy the init json with the unseal keys to the new pod:
oc cp openbao-init.json openbao-dr-0:/tmp/openbao-init.json -n openbao-drStep 2: Using awskms will reject Shamir -key-shares and -key-threshold. Use recovery shares instead:
oc exec -it openbao-dr-0 -n openbao-dr -- bao operator init -recovery-shares=1 -recovery-threshold=1→ Save the temporary recovery key and root token (discard after successful restore)
Step 3: Verify the pod is unsealed:
oc exec -it openbao-dr-0 -n openbao-dr -- bao status→
Initialized true, Sealed false, Seal Type awskms4Copy the snapshot to the new pod
oc cp backup-20260710.snap openbao-dr-0:/tmp/restore.snap -n openbao-dr5Login with the temporary root token (from init)
oc exec -it openbao-dr-0 -n openbao-dr -- bao login <temp-root-token>→ See Step 3
6Restore from the snapshot (forces restore even on different cluster ID)
oc exec -it openbao-dr-0 -n openbao-dr -- bao operator raft snapshot restore -force /tmp/restore.snap7Confirm auto-unseal after restore
Snapshot restores the original seal config. With the same KMS key and
aws-kms-creds, the node should auto-unseal:oc exec -it openbao-dr-0 -n openbao-dr -- bao status8Login with the usual root token
The temporary root token of Step 3 is not valid anymore after the restore was done
oc exec -it openbao-dr-0 -n openbao-dr -- bao login <root-token>9Verify all data is restored
oc exec -it openbao-dr-0 -n openbao-dr -- bao secrets listoc exec -it openbao-dr-0 -n openbao-dr -- bao auth listoc exec -it openbao-dr-0 -n openbao-dr -- bao policy listoc exec -it openbao-dr-0 -n openbao-dr -- bao kv list secret/10Cleanup
oc delete project openbao-dr