Secure lifecycle management for OpenBao on Kubernetes.
Warning
Pre-GA Release: OpenBao Operator is intended for real deployments, but the CRD API remains v1alpha1, minor releases may introduce breaking changes, and support is best-effort for the latest stable line only. For production, use the Hardened profile, keep admission enforcement enabled, pin explicit versions, and validate upgrades in staging.
OpenBao Operator is a Kubernetes operator for OpenBao that automates lifecycle management: provisioning, TLS, backups/restores, upgrades, horizontal read scaling, and multi-tenancy controls.
OpenBao Operator is maintained by KubeBao, an independent open-source project. It is not an official OpenBao project.
Follow the Getting started guide to choose a deployment model, install the operator, onboard a namespace, and create your first OpenBao cluster.
The documentation covers evaluation and production prerequisites, including platform-managed namespace security and private registries. For upgrades and removal, see Upgrade the operator and Uninstall the operator.
Full documentation is available at docs.kubebao.org.
 |
 |
| Installation, Operations, Day-2 Tasks | Component Design, Boundaries, Flows |
 |
 |
| Threat Model, Hardening, RBAC | Dev Setup, Coding Standards, Release |
 |
 |
| Validated K8s/OpenBao Versions | Ready-to-apply Example Manifests |
Recommended entry points:
For full details, see the Compatibility Matrix.
- Kubernetes: requires
v1.33+; release validation runs onv1.34–v1.36 - OpenBao: primary validation target on
mainis2.6.5, with config compatibility checks for2.6.5and2.7.2 - Support posture: best-effort support for the latest stable release line
OpenBaoCluster: Deploy and operate an OpenBao cluster (TLS, unseal, backups, upgrades).OpenBaoRestore: Restore a cluster from a backup (separate controller).OpenBaoTenant: Multi-tenant provisioning flow (multi-tenant mode).
- Two-Controller Architecture: Separate controller and provisioner components with least-privilege RBAC boundaries.
- Security Profiles with Guardrails:
DevelopmentvsHardened, enforced by admission policies to prevent insecure combinations. - Self-Init + OIDC Bootstrap: OpenBao self-initialization, with optional JWT/OIDC bootstrap via
spec.selfInit.oidc.enabled. - TLS, Your Way: Operator-managed TLS with rotation, external TLS, and ACME mode where OpenBao owns certificates (with ACME challenge Service support).
- Streaming Raft Backups: Snapshot streaming to S3/GCS/Azure with retention controls (no local staging).
- Declarative Restores: Restore workflows via
OpenBaoRestorewith operation locking and safe overrides. - Safe Upgrades: Rolling and blue/green upgrade strategies, including pre-upgrade snapshots.
RollingUpdateis the default recommended strategy. - Horizontal Read Scaling: Steady-state read replicas as non-voters, with a dedicated read Service and a shared primary endpoint that can include read replicas.
- Multi-Tenancy: Namespace-scoped tenancy model with policy enforcement via
OpenBaoTenant. Multi-tenant mode is the default and recommended production operating model.
- Threat model: Design assumptions and attacker model (Threat Model)
- RBAC boundaries: Least-privilege split between controller and provisioner (Tenant Boundaries)
- Guardrails: Validating admission policies that block dangerous settings before they reach the cluster (Admission Policies)
- Multi-tenancy: Namespace isolation guarantees and limits (Tenant Boundaries)
We welcome contributions! Please see the Contributing Guide for details on:
- Setting up your development environment.
- Running the PR-equivalent local gate (
devenv testfollowed by theoperator:bootstrap,operator:doctor, andoperator:ci-coreDevenv tasks). - Our AI-Assisted Contribution Policy.
Apache-2.0. See LICENSE.