---
id: w4/m5/t002
title: "Argo Application for OpenBao (pinned chart, base values + local overlay)"
worker: worker4
status: done
estimate: 35m
depends_on: [w4/m5/t001]
---

## Objective

Deploy OpenBao via GitOps exactly like Kratos/Hydra: a multi-source Argo Application in `deploy/gitops/base/` pinning the upstream `openbao/openbao` Helm chart with vendored values in `base/values/`, plus the local overlay patches (control-plane nodeSelector + toleration, PSA `privileged` namespace label, `local-path` PVC sizing) per the ADR's storage-backend decision.

## Context

- Pattern: `deploy/gitops/base/kratos.yaml` / `hydra.yaml` (multi-source: pinned chart + `base/values/*.values.yaml`), local overlay in `deploy/gitops/overlays/local/`.
- Local-CAPD quirks (memory: local-capd-cluster-quirks): pin pods to the control-plane node, PSA privileged label on the namespace, `local-path` storage class.
- Chart's built-in secret/init handling: disable anything that would put secret material in git (mirror `secret.enabled: false` from the Ory values).
- Single instance, cluster-internal only (no Ingress) — bex-api is the only consumer; tenants never talk to OpenBao directly.

## Steps

1. Add `deploy/gitops/base/openbao.yaml` (Argo Application, pinned chart version, sync wave after storage).
2. Add `deploy/gitops/base/values/openbao.values.yaml` per the ADR (storage backend, single replica, no ingress).
3. Add local-overlay patches: node pin, PSA label, `local-path` 1Gi sizing.
4. Register in `deploy/gitops/base/kustomization.yaml`.
5. Sync on the mock cluster; pod reaches Running (sealed state is fine until t003).

## Files

- `deploy/gitops/base/openbao.yaml` (new)
- `deploy/gitops/base/values/openbao.values.yaml` (new)
- `deploy/gitops/base/kustomization.yaml`
- `deploy/gitops/overlays/local/` (patches/values)

## Acceptance criteria

- [ ] Argo syncs OpenBao; pod Running on the mock cluster (sealed OK).
- [ ] Chart version pinned; no secret material in git.
- [ ] No Ingress: OpenBao is cluster-internal only.

## Out of scope

- Init/unseal (t003), auth roles (t004).
