Restore an unavailable or sealed OpenBao instance
Impact
Terraform cannot retrieve Proxmox, Flux, DNS, or alerting credentials. External Secrets consumers may stop refreshing. Existing workloads may keep running until credentials expire.
Triage
From an independent host, check the OpenBao process and Raft health, seal status, GCP KMS reachability, authentication, certificate validity, storage, and recent policy changes. For seal-specific checks, follow the OpenBao auto-unseal runbook.
Decide what to do
- If OpenBao is sealed and KMS is reachable, repair the auto-unseal identity or configuration. Do not initialize a new OpenBao cluster.
- If Raft or storage failed, preserve surviving data and use the tested OpenBao backup procedure before changing members.
- If OpenBao is cluster-hosted and Kubernetes is down, use the documented external recovery path. Production must not depend on unavailable in-cluster credentials to recover the cluster itself.
Check the resolution
Resolve the alert only when OpenBao is unsealed and healthy, operator login works, required secret paths are readable, Terraform can initialize, and External Secrets refreshes without errors.