Production blueprint (k8s)

This document outlines recommendations for operating OpenBao in a production environment.

Production Blueprint

Infrastructure

Please follow the OpenBao project reference to deploy the OpenBao charms on hosts of appropriate size for your deployment.

High Availability

OpenBao should be deployed with a total of 5 units.

Observability

OpenBao should be integrated with Canonical Observability Stack:

  • OpenBao should be integrated with OpenTelemetry Collector using the cos-agent charm relation interface.

  • OpenTelemetry Collector should be integrated with COS using the logging, send-remote-write, and grafana-dashboards-provider charm relation interfaces.

Storage

The OpenBao charm declares minimum storage sizes for its volumes. Juju will provision at least these amounts when deploying.

Important

Storage declarations cannot be changed after deployment on Kubernetes.

The charm defines the following storage volumes:

Storage name

Purpose

Minimum size

openbao-raft

Raft data directory

10G

config

OpenBao configuration files

5M

certs

TLS certificates

5M

tmp

Temporary files

5G

You can provision larger volumes at deploy time using the --storage flag:

juju deploy openbao-k8s openbao --trust \
  --storage openbao-raft=50G \
  --storage tmp=10G

Note that some filesystems (e.g. XFS) enforce a minimum allocation unit larger than the declared minimums. In such cases, use the --storage flag to specify sizes compatible with your filesystem.

Backup and Restore

OpenBao should be integrated with an S3 provider to conduct regular backup operations.