Use a simplified shell loop (super fancy) to unseal openbao-0, openbao-1, and openbao-2 with Shamir keys from openbao-init.json. Based on OpenBao Part 6 — Approach 1: Manual Initialisation.
Prerequisites checklist
Confirm these before running steps:
- PRE-05Install OpenBao with Helm (HA on OpenShift)
- Pod openbao-0 is Running (may be 0/1 Ready while sealed)
jqinstalled on your workstation- PRE-06Initialise the cluster — save unseal keys and root token
1Confirm OpenBao pods are present and openbao-0 is running:
2Run the unseal loop from the Commands / YAML tab** (or save as
openbao-manual-unseal.sh).3The script:
→ Unseals openbao-0, openbao-1, openbao-2 (3 different keys each, threshold 3)
→ Waits 30 seconds between pods so the next pod can pull the image and start
→ Uses
jq to read keys from openbao-init.json4Verify all server pods are Ready:
oc get pods -n openbao→ openbao-0, openbao-1, openbao-2: 1/1 Running
5Verify cluster status on openbao-0:
oc exec -ti openbao-0 -n openbao -- bao status→
Initialized true, Sealed falseRe-Login
oc exec -ti openbao-0 -n openbao -- bao login→ Enter the root token from
openbao-init.json6List Raft peers:
oc exec -ti openbao-0 -n openbao -- bao operator raft list-peers→ Three voters: openbao-0 (leader), openbao-1, openbao-2