Implement a safe secret rotation pattern using check-and-set (CAS) to prevent concurrent write conflicts. Manual CLI rotation is followed by a CronJob that mounts the rotation script from a ConfigMap and authenticates to OpenBao via Kubernetes auth (ServiceAccount JWT → short-lived OpenBao token).
Prerequisites checklist
Confirm these before running steps:
- TC-OPENBAO-KV-002KV v2 Metadata and Custom Metadata
- Root token or policy admin access (to configure OpenBao policy and Kubernetes auth role)
1Manual rotation — read current version for CAS
bao kv get -format=json secret/myapp/config | jq '.data.metadata.version'2Manual rotation — write with CAS and UTC timestamp
VERSION=$(bao kv get -format=json secret/myapp/config | jq -r '.data.metadata.version')bao kv put -cas=${VERSION} secret/myapp/config password=newP@ssw0rd rotated_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)3Verify the rotation
bao kv get secret/myapp/config→ new password shown; version incremented
4Verify rollback — previous version still readable
bao kv get -version=${VERSION} secret/myapp/config5OpenBao — policy for the rotation workload
bao policy write secret-rotation - <<'EOF'
path "secret/data/myapp/config" {
capabilities = ["create", "update", "read"]
}
path "secret/metadata/myapp/config" {
capabilities = ["create", "update", "read"]
}
EOF→ Success! Uploaded policy: secret-rotation
6OpenBao — enable Kubernetes auth (skip if already enabled)
bao auth list | grep kubernetes/ || bao auth enable kubernetes→ Success! Enabled kubernetes auth method at: kubernetes/
7OpenBao — configure Kubernetes auth (one-time; run from openbao-0 with in-cluster SA creds)
Log in to openbao-0 with the token of your exported JSON file.
oc exec -ti openbao-0 -n openbao -- bao login "$(jq -r '.root_token' openbao-init.json)"Configure Kubernetes auth
oc exec openbao-0 -n openbao -- sh -c 'bao write auth/kubernetes/config token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" kubernetes_host="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT" kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'→ Success! Data written to: auth/kubernetes/config
8OpenBao — Kubernetes auth role bound to CronJob ServiceAccount
bao write auth/kubernetes/role/secret-rotation bound_service_account_names=openbao-rotation bound_service_account_namespaces=openbao policies=secret-rotation ttl=15m→ Success! Data written to: auth/kubernetes/role/secret-rotation
9Copy the Kubernetes objects from the Commands / YAML tab
Copy everything between
cat <<'EOF' | oc apply -f - and EOFThis includes three objects:
- ServiceAccount to run the CronJob
- ConfigMap to store the rotation script
- CronJob to schedule the rotation
10Test — trigger a one-off Job from the CronJob
oc create job --from=cronjob/secret-rotation manual-rotate-1 -n openbaooc logs job/manual-rotate-1 -n openbao -f→ login succeeds, CAS write succeeds, Secret rotated message printed