Migrate the TLS HA OpenBao cluster from TC-OPENBAO-OCP-001 (Shamir seal) to transit auto-unseal using the transit instance from PRE-09.
Per OpenBao seal migration: migrate standby nodes first (one at a time, -migrate each), then step down the leader so a standby becomes active and finishes migration. Do not -migrate on the current leader first. Do not delete all pods at once.
Prerequisites checklist
Confirm these before running steps:
- TC-OPENBAO-OCP-001Enable TLS end-to-end on OpenBao (OpenShift)
- Cluster Shamir, unsealed (
Seal Type: shamir,Sealed: false) openbao-init.jsonwith unseal keys on your workstation- PRE-09Deploy a Transit OpenBao Instance for Auto-Unseal
1Verify cluster is healthy
oc get pods -n openbaooc exec -ti openbao-0 -n openbao -- bao status→ All of openbao-0/1/2 are 1/1 Ready, Seal Type shamir, Sealed false
2Verify transit instance
oc get pods -n openbao-transitoc exec -ti openbao-transit-0 -n openbao-transit -- bao status→ Transit pod 1/1 Ready, Sealed false
3Note leader and standbys
oc exec -ti openbao-0 -n openbao -- bao login $(jq -r '.root_token' openbao-init.json)oc exec -ti openbao-0 -n openbao -- bao operator raft list-peers→
export LEADER=openbao-0 (State: leader / HA Mode: active)→ Standbys = the other two pods
4Add transit seal to TLS Helm values (see Commands / YAML tab)
Add
seal "transit" { ... } to your TC-OPENBAO-OCP-001 values.→
address: http://openbao-transit.openbao-transit.svc:8200→
key_name: autounseal, mount_path: transit/5Helm upgrade
helm upgrade openbao openbao/openbao -n openbao -f openbao-ha-values-tls-transit-unseal.yamlConfigMap conflict (
Mozilla field manager): oc delete configmap openbao-config -n openbao then re-run6Migrate first standby — leader stays up (keeps Raft quorum)
export STANDBY=openbao-2 # a pod that is NOT $LEADERoc delete pod $STANDBY -n openbaooc exec -ti $STANDBY -n openbao -- bao operator unseal -migrate $(jq -r '.unseal_keys_b64[0]' openbao-init.json)oc exec -ti $STANDBY -n openbao -- bao operator unseal -migrate $(jq -r '.unseal_keys_b64[1]' openbao-init.json)oc exec -ti $STANDBY -n openbao -- bao operator unseal -migrate $(jq -r '.unseal_keys_b64[2]' openbao-init.json)7Migrate second standby — same on the other non-leader pod
export STANDBY=openbao-1oc delete pod $STANDBY -n openbaowatch oc get pods -n openbao3×
bao operator unseal -migrate with different keys on $STANDBY8Step down the leader
oc exec -ti $LEADER -n openbao -- bao operator step-downsleep 10oc exec -ti openbao-0 -n openbao -- bao operator raft list-peers→ A former standby is now State: leader
export NEW_LEADER=openbao-1 # adjust to actual new leader9Monitor migration completion on new leader
oc logs $NEW_LEADER -n openbao --tail=50→ Watch for seal migration completion in the log
oc exec -ti $NEW_LEADER -n openbao -- bao status→ Seal Type transit, Recovery Seal Type shamir, Sealed false
→ Seal Migration in Progress: false, HA Mode: active
10Restart former leader — auto-unseals via transit
11Verify all pods
oc get pods -n openbao → all 1/1 Readyoc exec -ti openbao-0 -n openbao -- bao operator raft list-peers