Use this guide to install the operator with an explicit ownership model, create the first cluster, and identify the controls required before production.
Before you begin
You need:
- a Kubernetes cluster that meets the compatibility requirements;
- cluster-admin access to install CRDs, RBAC, and admission policies;
kubectlconfigured for the cluster;- Helm with OCI registry support for the recommended multi-tenant install;
- ownership decisions for the operator namespace, target namespace, and OpenBao administration.
If the cluster cannot pull from public registries, follow Use private registries to mirror runtime images and configure registry credentials before installing the operator.
Choose the outcome
| Outcome | Use this route | Exit condition |
|---|---|---|
| Evaluate the operator | Install in multi-tenant mode and create a disposable Development cluster | The tenant handoff exists and the cluster reports Available=True |
| Prepare production | Choose the deployment model, then complete the Hardened configuration and operational prerequisites | Human access, external trust, storage, backup, restore, monitoring, and upgrade ownership are tested |
| Operate one dedicated namespace | Install in single-tenant mode with Helm or the maintained Kustomize overlay | Watched namespace, target RoleBinding, controller identity, and namespace all match |
Choose the tenancy path
Start with Choose a deployment model to decide tenancy, security profile, bootstrap, TLS, and installation ownership.
For multi-tenant operation:
- Install the operator and verify the controller, Provisioner, CRDs, admission policies, and identities.
- Onboard a namespace through
OpenBaoTenantand verify the tenant RoleBinding. - Create the first cluster.
- Prepare for production operations.
For one dedicated namespace:
- Install in single-tenant mode and verify the watched namespace and controller identity.
- Skip
OpenBaoTenant; the Provisioner is not part of this model. - Create the first cluster in the watched namespace.
- Prepare for production operations.
Review supporting decisions
- Single-tenant mode explains the controller-only Helm and Kustomize paths and their namespace contract.
- Operator authentication maps ServiceAccounts, projected JWTs, OpenBao roles, and human bootstrap access.
- Operator authorization records the distinct controller, backup, restore, and upgrade policies.
- Compatibility separates chart constraints from the versions exercised by current CI.
Finish Get Started with
- a repeatable, version-pinned operator installation;
- an explicit multi-tenant or single-tenant namespace boundary;
- a verified first-cluster status and workload state;
- separate operator and human authentication paths;
- named owners and tested procedures for backup, restore, exposure, monitoring, and upgrade.