Migrate the TLS HA cluster from TC-OPENBAO-OCP-001 (Shamir seal, initialised via PRE-06 and PRE-07) to AWS KMS auto-unseal.
Prerequisites checklist
Confirm these before running steps:
- TC-OPENBAO-OCP-001Enable TLS end-to-end on OpenBao (OpenShift)
- Cluster Shamir, unsealed (
Seal Type: shamir,Sealed: false) openbao-init.jsonwith Shamir unseal keys on your workstation- AWS credentials via Kubernetes Secret, IRSA, or Pod Identity (cluster on AWS recommended)
1Verify cluster is healthy (Shamir, post OCP-001)
oc get pods -n openbaooc exec -ti openbao-0 -n openbao -- bao status→ Seal Type shamir, Sealed false, all pods 1/1 Ready
2Prepare AWS KMS
aws kms create-key --description 'OpenBao Auto-Unseal Key' --region <region>→ Note the key ARN
3Create AWS credentials Secret (or use IRSA / Pod Identity)
oc create secret generic aws-kms-creds -n openbao \--from-literal=AWS_ACCESS_KEY_ID=<id> \--from-literal=AWS_SECRET_ACCESS_KEY=<secret>4Note leader and standbys
oc exec -ti openbao-0 -n openbao -- bao login $(jq -r '.root_token' openbao-init.json)oc exec -ti openbao-0 -n openbao -- bao operator raft list-peers→
export LEADER=openbao-0 (State: leader)5Build Helm values — add seal "awskms" to TLS values (see Commands / YAML tab)
→
kms_key_id: your KMS key ARN→
region: AWS region→ AWS creds via
extraSecretEnvironmentVars from aws-kms-creds Secret6Helm upgrade
helm upgrade openbao openbao/openbao -n openbao -f openbao-ha-values-tls-awskms-unseal.yamlConfigMap conflict:
oc delete configmap openbao-config -n openbao then re-run7Migrate first standby — leader stays up
export STANDBY=openbao-2oc delete pod $STANDBY -n openbaowatch oc get pods -n openbaooc exec -ti $STANDBY -n openbao -- bao operator unseal -migrate $(jq -r '.unseal_keys_b64[0]' openbao-init.json)oc exec -ti $STANDBY -n openbao -- bao operator unseal -migrate $(jq -r '.unseal_keys_b64[1]' openbao-init.json)oc exec -ti $STANDBY -n openbao -- bao operator unseal -migrate $(jq -r '.unseal_keys_b64[2]' openbao-init.json)→ Follower may stay 0/1 Ready until migration completes — continue
8Migrate second standby
export STANDBY=openbao-1oc delete pod $STANDBY -n openbaowatch oc get pods -n openbao3×
bao operator unseal -migrate with different Shamir keys9Step down the leader
oc exec -ti $LEADER -n openbao -- bao operator step-downsleep 15oc exec -ti openbao-0 -n openbao -- bao operator raft list-peersexport NEW_LEADER=openbao-1 # pod with State: leader10Verify migration on new leader
oc logs $NEW_LEADER -n openbao --tail=50oc exec -ti $NEW_LEADER -n openbao -- bao status→ Seal Type awskms, Recovery Seal Type shamir, Sealed false
→ Seal Migration in Progress: false, HA Mode: active
11Restart former leader — auto-unseals via KMS
12Restart standbys — auto-unseal via KMS
oc delete pod openbao-1 openbao-2 -n openbaowatch oc get pods -n openbao→ All three 1/1 Ready