autoInit — automatically initialise the cluster on first deploy
recoveryKeyRecipients : [str] — age public keys used to encrypt recovery keys
recoveryShares : int = 3
recoveryThreshold : int = 2
pki — PKI secrets engine with root CA
roles
roles : [{…}] — PKI roles to create
*
allowIpSans : bool = true
allowSubdomains : bool = true
allowedDomains : str — allowed domains for certificates
maxTtl : str = "720h"
name : str — role name
commonName : str — common name for the root CA certificate
maxTtl : str = "87600h" — maximum lease TTL for the PKI engine
settings
settings : open submodule of attribute set of anything
storagePath : str = "/var/lib/openbao"
transitAddress : str — address of the transit seal provider (e.g
ui : bool = true
apiPort : u16 = 8200
authPasswordFile : ?str — path to file containing the userpass auth password for the services account
clusterNodes : [str] — hostnames of all nodes in the OpenBao cluster
clusterPort : u16 = 8201
configure : strings concatenated with "\n" — idempotent bao CLI commands run after authentication succeeds
configureTokenFile : ?str — path to a pre-existing OpenBao token
dataNetwork : str = "infra"
servicesPolicy : strings concatenated with "\n" = ''
path "kv/*" { capabilities = ["create","read","update","patch","list"] }
path "pki/*" { capabilities = ["create","read","update","list"] }
path "sys/mounts/*" { capabilities = ["create","read","update","sudo"] }
path "sys/mounts" { capabilities = ["read","list"] }
path "sys/auth/*" { capabilities = ["create","read","update","sudo"] }
path "sys/auth" { capabilities = ["read","list"] }
path "sys/policies/acl/*" { capabilities = ["create","read","update","list"] }
path "auth/*" { capabilities = ["create","read","update","list"] }
'' — HCL policy attached to the services user
transitTokenFile : str — path to file containing the transit auto-unseal token