---
id: w1/m10/t001
title: One-time prod bao-init — unseal keys + root token into .env (names mirrored in templates)
worker: worker1
status: done
estimate: 25m
depends_on: []
---

## Objective

Initialize the prod OpenBao once, by hand, against the prod kubeconfig: `scripts/bao-init.sh` generates the Shamir unseal keys + root token and writes them into the operator's local `.env`. Mirror the **names only** (`BAO_UNSEAL_KEY_1..3`, `BAO_ROOT_TOKEN`) into `.env.example` and `.env.template` per the repo rule.

## Context

- docs/ADR013-secrets.md "Prod deploy path" step 1; `scripts/bao-init.sh` is idempotent (detects "already initialized," just unseals).
- **Never commit or print `.env` contents / the keys** (repo rule). This task's output is local `.env` state + template name mirrors only.

## Steps

1. Run `bash scripts/bao-init.sh` with the prod kubeconfig; verify seal status is unsealed.
2. Confirm `.env` carries the four vars; add the names (+ comments, no values) to `.env.example` and `.env.template`.

## Files

- `.env` (local, gitignored), `.env.example`, `.env.template`

## Acceptance criteria

- [ ] `bao status` (or the script's check) shows initialized + unsealed on prod.
- [ ] Templates carry the four `BAO_*` names with no values; nothing secret in git.

## Out of scope

- CI wiring (t002); root-token rotation runbook (already flagged in ADR013-secrets.md consequences).
