Use status for the latest controller observation and Events for the sequence that led to it. A condition’s reason
and message contain the actionable detail; do not treat the high-level phase as a complete health check.
Inspect current state
kubectl -n <namespace> get openbaocluster <name> \
-o jsonpath='{.status.conditions}' | jq
kubectl -n <namespace> get openbaorestore <name> \
-o jsonpath='{.status.conditions}' | jq
kubectl -n <namespace> get events --sort-by=.lastTimestamp
Use kubectl describe on the parent custom resource to see status and recent Events together.
Workflow checkpoints
| Workflow | Conditions to inspect |
|---|---|
| Hardened cluster with External TLS | Available, TLSReady, UserAccessBootstrap, ProductionReady |
| Hardened cluster with ACME | Available, ACMEIntegrationReady, ACMECacheReady, UserAccessBootstrap, ProductionReady |
| Gateway exposure | GatewayIntegrationReady; inspect Route parent status for controller detail |
| Strict NetworkPolicy | APIServerNetworkReady |
| Scheduled backups | BackupConfigurationReady, BackingUp |
| File audit storage | AuditFileStorageReady; inspect Degraded when recreation is required |
| Restore | RestoreConfigurationReady, then RestoreComplete; RecoveryReleased after an uncertain outcome |
| Restore tests | Passed in status.backup.restoreTest.conditions on the source cluster |
| Approved policy repair | PolicyReconciliationReady; inspect warning events when false |
OpenBaoCluster status
status.phase is one of Initializing, Running, Upgrading, BackingUp, or Failed. Conditions provide the
specific contract.
Service and integration conditions
| Type | Signal |
|---|---|
Available | Ready voter workload replicas |
TLSReady | TLS assets required by the selected mode |
ACMEIntegrationReady | Operator-known ACME reachability and Gateway prerequisites |
ACMECacheReady | Shared ACME state for HA or blue-green topologies |
GatewayIntegrationReady | Referenced Gateway, GatewayClass, listener, and managed Route attachment |
IngressIntegrationReady | Managed Ingress prerequisites and load-balancer progress |
APIServerNetworkReady | Kubernetes API egress configuration in standard NetworkPolicies and the optional Cilium policy; does not probe live connectivity |
AuditFileStorageReady | Shared audit PVC readiness and workload mount adoption |
Security and production conditions
| Type | Signal |
|---|---|
ProductionReady | Operator-known Hardened posture checks; not API stability or project support |
UserAccessBootstrap | Heuristic recognition of a human login bootstrap path; not proof that login works |
CloudUnsealIdentityReady | Operator-known cloud KMS identity prerequisites |
EtcdEncryptionWarning | The operator cannot verify Kubernetes etcd encryption |
SecurityRisk | Development or otherwise relaxed security controls |
NodeSecurityCapabilityMismatch | Requested workload hardening is unavailable on the node platform |
Operation and storage conditions
| Type | Signal |
|---|---|
Upgrading | Upgrade orchestration is active, idle, or failed |
BackingUp | Backup orchestration is active or idle |
BackupConfigurationReady | Operator-known backup authentication, storage, identity, and egress prerequisites |
StorageConfigured | A consistent voter StorageClass is configured or resolved; not proof that a resize completed |
ReadReplicaStorageConfigured | Equivalent storage selection for the read-replica pool |
ReadReplicasReady | Desired read-replica Pods are Ready |
ReadServingAvailable | An observed read replica can serve reads for the validated OpenBao version |
RaftMembershipReady | Observed voter and non-voter membership matches the declared topology |
ReadReplicasAutopilotHealthy | Autopilot reports healthy read-replica peers |
Degraded | A workload, operation, configuration, or break-glass problem needs attention |
Observed OpenBao conditions
| Type | Signal |
|---|---|
OpenBaoInitialized | Initialization state observed from Kubernetes service-registration labels |
OpenBaoSealed | Seal state observed from service-registration labels |
OpenBaoLeader | Leader discovery from service-registration labels |
These three conditions report the labels OpenBao publishes; they are not independent API probes.
Policy reconciliation status
PolicyReconciliationReady is present only when spec.reconcilePolicies is enabled. It is True after the current
runtime bundle is verified, False while pending or failing, and Unknown when reconciliation is paused or blocked by
the security profile. Policy failures also contribute to Degraded.
Field under status.workload | Meaning |
|---|---|
policyReconciliation.revisions | Policy name to verified content digest; an empty value means missing or changed contents awaiting repair; an absent key means unobserved |
policyReconciliation.attemptedRevision | Runtime bundle used for the latest attempt and its retry schedule |
policyReconciliation.lastVerified | Time of the last successful complete verification |
policyReconciliation.retryAfter | Earliest retry for the same attempted runtime bundle after a failure |
policyReconciliation.lastError | Policy failure, independent of status.workload.lastError |
policyRevision | Last completely verified runtime bundle; informational and not an operation gate |
Failed policy reads preserve previous observations. See operation gating for how backup and upgrade use them, and policy enrollment for administrator actions.
OpenBaoRestore status
status.phase moves through Pending, Validating, and Running, then ends Completed, Failed, or Unknown.
Unknown means the snapshot was submitted but its application is not confirmed; see
Recover an uncertain restore.
| Type | Signal |
|---|---|
RestoreConfigurationReady | Operator-known authentication, storage, identity, and egress prerequisites |
RestoreComplete | Terminal restore result |
OperationLockOverride | A forced disaster-recovery restore cleared another operation lock |
RecoveryReleased | Whether management was handed back after an uncertain outcome; the reason names the current step |
AmbientIdentityAssumed means the operator identified a provider default chain. It does not prove that the cloud-side
role, service account, or permission binding works.
OpenBaoTenant status
Require status.provisioned: true and Provisioned=True for the current generation. When provisioning is blocked or
fails, the condition is false with a specific reason and status.lastError retains the failure summary for
compatibility.
Kubernetes Events
The operator emits these lifecycle reasons on parent resources. Normal records progress or accepted input;
Warning records failure, contention, a safety override, or another state that needs attention.
| Workflow | Event reasons |
|---|---|
| Cluster safety and storage | ProfileNotSet, DevelopmentProfile, UnsafeAdmissionDisabled, AmbientUnsealIdentity, StaticUnsealInUse, RootTokenStored, image-verification reasons, PVCResize, PVCResizeLeaderStepDown, PVCResizePodRestart |
| Initialization | InitStarted, InitCompleted, InitFailed |
| Policy repair | PolicyReconciliationFailed |
| Tenant Secret RBAC | TenantSecretRBACSynchronized |
| Upgrade | UpgradeStarted, PreUpgradeSnapshotJobCreated, PreUpgradeSnapshotCompleted, PreUpgradeSnapshotFailed, RollingRetryRequested, RollingRetryAccepted, BlueGreenHoldEntered, BlueGreenPromotionApproved, UpgradeComplete, UpgradeFailed, RollbackStarted, BreakGlassEntered, BreakGlassAcknowledged, OperationLockBlocked |
| Backup | BackupManualTriggerAccepted, BackupSkipped, BackupStarted, BackupIdentityConfiguration, BackupJobCreated, BackupCompleted, BackupFailed, OperationLockBlocked |
| Restore | RestoreValidationStarted, RestoreStarted, RestoreIdentityConfiguration, RestoreJobCreated, RestoreCompleted, RestoreFailed, OperationLockBlocked, OperationLockLost, OperationLockOverride |
| Tenant provisioning | TenantProvisioned, TenantRBACCleaned, TenantProvisioningBlocked, TenantProvisioningFailed |
TenantRBACCleaned confirms that tenant RBAC and the operator-managed ResourceQuota and LimitRange were removed.
Pod Security labels are intentionally outside that event’s cleanup contract.
Controllers also write structured audit records to their logs for security-sensitive and lifecycle actions. Condition types are API surface. Reason, Event, and audit-event values can expand as the controller gains new failure modes.