Repository navigation
feat(openbao): check every pod and run the HA guard before upgrades - #38
Merged
Merged
Conversation
WP3 of the Tier 2 operator unlock plan. upgrade-in-place.sh now checks the seal state of every OpenBao pod, not only openbao-0, and runs the rolling-restart guard from dmf-infra before any OpenBao restart. On a single replica the guard passes when that pod is unsealed. `--skip-unseal-check` keeps its old seal-only meaning and never skips the guard. unseal-openbao.sh gains --status-all. Merge after the dmf-infra change that adds the guard playbook. Refs dmfdeploy/dmfdeploy#864 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
Refs dmfdeploy/dmfdeploy#864 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
znerol2
added
the
hold
unseal-openbao.sh required macOS's `security` command in every mode on a non-sandbox profile. The status modes read seal state over ssh and never use it, so on a Linux host (the CI runner included) --status and --status-all exited before printing anything. Require it only to unseal. Refs dmfdeploy/dmfdeploy#864 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
lkirc
approved these changes
Nov 8, 2026
lkirc
left a comment
lkirc
left a comment
There was a problem hiding this comment.
Static review complete for b34e164: no blocking findings. The all-pod seal precheck and unconditional restart guard are in place before upgrade stages; the CI change is a scoped test invocation. The existing hold remains for dmf-infra#130.
znerol2
removed
the
hold
Contributor
Author
|
dmfdeploy/dmf-infra#130 merged, so the guard playbook this change calls is on dmf-infra main. Releasing the hold. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The dmf-env half of WP3 in
docs/plans/operator-unlock-tier2-plan.md(umbrella). The plan says the upgrade procedure refuses to restart the next OpenBao node while a restarted one is still sealed. This makesupgrade-in-place.shdo that.On hold until dmf-infra#130 merges. This change calls the guard playbook that PR adds.
Changes
upgrade-in-place.sh: stage 1 checks the seal state of every OpenBao pod, not onlyopenbao-0. A new stage 1b runs the dmf-infra rolling-restart guard before any OpenBao restart. On a single replica, the guard passes when that pod is unsealed.--skip-unseal-checkkeeps its old seal-only meaning and never skips the guard, and no flag skips it.unseal-openbao.sh: gains--status-all. To unseal a specific pod, passOPENBAO_POD.tests/upgrade-in-place-guard.shcovers every-pod status, a sealed second pod, and the guard call with the old flag set. It's wired into CI.Testing
tests/upgrade-in-place-guard.shpasses all cases.tests/wizard-noninteractive-parity.shfails locally, the same way on an untouchedmaincheckout, because of a local jq/yq version mismatch. CI runs its own versions.Refs dmfdeploy/dmfdeploy#864