---
id: w1/m7/t006
title: OpenBao Raft snapshot backup (reuse the etcd-backup CronJob pattern)
worker: worker1
status: done
estimate: 30m
depends_on: []
---

## Objective

Nightly `bao operator raft snapshot save` → object storage, so losing the single OpenBao node no longer loses every tenant credential. Reuse the proven etcd-backup shape (w1/m1): a CronJob chart with the same S3 secret pattern, retain-N pruning, `concurrencyPolicy: Forbid`; append a restore runbook paragraph to docs/ADR013-secrets.md.

## Context

- docs/ADR013-secrets.md consequences: "OpenBao must join the … backup/HA work before real tenant credentials live in it; losing the single node loses everything."
- Pattern to copy: `deploy/gitops/charts/etcd-backup/cronjob.yaml` + `deploy/gitops/base/etcd-backup.yaml` (excluded by the local overlay).
- Snapshot auth: needs a token/approle with `sys/storage/raft/snapshot` read — scope minimally; secret out-of-band like `etcd-backup-s3`.

## Steps

1. Chart `deploy/gitops/charts/openbao-backup/` (CronJob + Secret ref), Argo app in base, excluded in the local overlay.
2. Verify a snapshot lands in the bucket and `bao operator raft snapshot restore` works on a scratch instance.
3. Restore runbook paragraph in docs/ADR013-secrets.md.

## Files

- `deploy/gitops/charts/openbao-backup/`, `deploy/gitops/base/`
- `deploy/gitops/overlays/local/kustomization.yaml`
- `docs/ADR013-secrets.md`

## Acceptance criteria

- [ ] Nightly snapshot object appears in the bucket; retain-N prunes; restore verified once on a scratch instance.

## Out of scope

- OpenBao HA/raft quorum; KMS auto-unseal.
