kubernetesstoragePractitioner

Deploying OpenBao on Kubernetes with CloudNativePG: A Step-by-Step Guide

5 min read CNCF BlogSep 16, 2026Reviewed for accuracy

Practitioner — Hands-on experience recommended

OpenBao, the Linux Foundation’s open-source fork of HashiCorp Vault, provides a secure way to manage secrets. When paired with CloudNativePG, you can turn any PostgreSQL cluster into a highly available, self-healing database that doesn’t rely on cloud services. This combination not only enhances security but also simplifies database management in Kubernetes environments.

The setup involves configuring OpenBao’s PostgreSQL storage backend to utilize CloudNativePG’s features. You’ll define a Cluster resource that points to the latest minimal PostgreSQL image, ensuring that your deployments are always up to date. Key parameters like dataDurability, which defaults to 'required', ensure zero data loss at the cost of potential write pauses if a standby is unavailable. Additionally, the pg_hba.conf rules are crucial for enforcing certificate authentication for the roles OpenBao uses, preventing unauthorized access.

In production, ensure you have the prerequisites: Docker, Kind, Helm, and kubectl. Pay attention to the max_connections parameter, which is set to 100 by default, as it can limit your application’s scalability. The version of PostgreSQL you’ll be using is 18.6, so keep an eye on updates to the image catalog for any patches or improvements. This setup is powerful, but it requires careful configuration to avoid pitfalls, especially around authentication and connection limits.

Key takeaways

→Configure the Cluster resource to use the latest minimal PostgreSQL image for automatic updates.
→Set `dataDurability` to 'required' for zero data loss, but be aware of potential write pauses.
→Define `pg_hba` rules to enforce certificate authentication for OpenBao roles.
→Ensure you have Docker, Kind, Helm, and kubectl installed before starting the setup.
→Monitor the `max_connections` parameter to avoid scalability issues in high-load scenarios.

Why it matters

Integrating OpenBao with CloudNativePG enhances security and reliability in managing secrets, which is critical for modern applications. This setup allows for seamless scaling and self-healing capabilities in your database layer.

Code examples

Bash

1# Clone the CNPG Playground repository
2 git clone https://github.com/cloudnative-pg/cnpg-playground.git
3 cd cnpg-playground
4 # 1. Provision a single local cluster labelled "openbao"
5 ./scripts/setup.sh openbao
6 # 2. Deploy CloudNativePG, cert-manager, the Barman Cloud plugin and a
7 #    ClusterImageCatalog only, skipping the demo databases
8 REQUIREMENTS_ONLY=true ./demo/setup.sh

YAML

1apiVersion: postgresql.cnpg.io/v1
2kind: Cluster
3metadata:
4  name: openbao-db
5  namespace: openbao
6spec:
7  instances: 3
8
9  imageCatalogRef:
10    apiGroup: postgresql.cnpg.io
11    kind: ClusterImageCatalog
12    name: postgresql-minimal-trixie
13    major: 18
14
15  postgresql:
16    synchronous:
17      method: any
18      number: 1
19
20    pg_hba:
21      - hostssl openbao openbao all cert
22      - hostssl openbao openbao-rw all cert
23      - hostnossl openbao openbao all reject
24      - hostnossl openbao openbao-rw all reject
25
26    parameters:
27      max_connections: '100'
28      log_checkpoints: 'on'
29      log_lock_waits: 'on'
30      hot_standby_feedback: 'on'
31      shared_memory_type: 'sysv'
32      dynamic_shared_memory_type: 'sysv'
33
34  storage:
35    size: 10Gi

YAML

1apiVersion: postgresql.cnpg.io/v1
2kind: DatabaseRole
3metadata:
4  name: role-openbao
5  namespace: openbao
6spec:
7  cluster:
8    name: openbao-db
9  name: openbao
10  login: true
11  clientCertificate:
12    enabled: true
13  databaseRoleReclaimPolicy: retain

When NOT to use this

The official docs don't call out specific anti-patterns here. Use your judgment based on your scale and requirements.

Want the complete reference?

Read official docs

Test what you just learned

Quiz questions written from this article

Take the quiz →

Linux Foundation🔥 SEPTEMBER PROMOSponsor

35% off certifications and e-learning with code SEPT26BTS35, or 40% off bundles and instructor-led training with SEPT26BTS40. New this month: the MCPA (Model Context Protocol Associate) certification.

Claim the discount →

Deploying OpenBao on Kubernetes with CloudNativePG: A Step-by-Step Guide

Key takeaways

Why it matters

Code examples

When NOT to use this

More on this topic

Hardening Kubernetes Storage: Bind Mount Options and EmptyDir Permissions

Kubernetes CBT API: Navigating the Beta Transition

Mastering Kubernetes Disaster Recovery: Lessons from Real Failures