Set up a backup strategy combining Raft snapshots with configuration exports. Schedule automated backups to a local PVC with retention (keep last 30 snapshots). Includes snapshot verification.
Prerequisites checklist
Confirm these before running steps:
- TC-OPENBAO-OCP-001Enable TLS end-to-end on OpenBao (OpenShift)
- TC-OPENBAO-HA-002Raft Snapshot and Restore
- StorageClass available for a 20Gi PVC in the
openbaonamespace
1Get current (raft) leader
bao operator raft list-peers2Create a backup policy:
This policy grants read on sys/storage/raft/snapshot so the CronJob can later create a snapshot without using the root token.
bao policy write backup - <<'EOF'
path "sys/storage/raft/snapshot" {
capabilities = ["read"]
}
EOF→ Success! Uploaded policy: backup
3Create a periodic token for the backup job
bao token create -policy=backup -period=24h -orphan→ Success! A token s.xxxx is created
4Store the backup token as a Kubernetes secret
Use the token of Step 3
oc create secret generic openbao-backup-token --from-literal=token=<backup-token> -n openbao5Create the backup CronJob
manifest in Commands / YAML tab
This will create a CronJob object
6Run a test backup manually
oc create job --from=cronjob/openbao-backup test-backup -n openbao7Verify the backup completed
oc logs job/test-backup -n openbaoExpected output:
Creating Raft snapshot...
Snapshot size: 88.0K
Copying snapshot to PVC...
Backup complete: /backups/openbao-snapshot-20260717-065251.snap
-rw------- 1 1000970000 1000970000 86.0K Jul 17 06:52 /backups/openbao-snapshot-20260717-065251.snap8Export OpenBao configuration for disaster recovery documentation
bao secrets list -format=json > secrets-engines.jsonbao auth list -format=json > auth-methods.jsonbao policy list -format=json > policies.json9Verify the snapshot is stored on the PVC
The retention the CronJob is following is 30 days >> ... tail -n +31 | xargs -r rm -f
Spin up a dummy pod to list the currently stored backups on the PVC
see Commands / YAML tab for the manifest