Clean Up the Bootstrap Secrets

The openbao-bootstrap-seeds-<name> Secrets exist only to seed OpenBao’s KV store on the first sync. Once the stack is up and the Verify the Deployment steps confirm the values are in KV, remove them so the plaintext credentials no longer sit in the cluster.

Run the playbook from a machine that can reach the active BCM head node over SSH as root with your SSH key. Ansible runs the tasks on the head node. Run the kubectl command following on the head node too, where it reaches k8s-admin.

Back up openbao-admin-credentials offline first. It is your break-glass nmc-admin login, and the cleanup requires you to confirm the backup. Read the password with the step in Log in as the nmc-admin operator. For the seal key, the Raft snapshot, and recovery shares, follow the OpenBao backup procedure (OpenBao).

ansible-playbook nvidia.nmc.deploy_k8s_bootstrap_secrets \
  -i "<head-node-ip>," \
  -u root \
  -e k8s_cluster_name=k8s-admin \
  -e role_action=cleanup \
  -e k8s_bootstrap_secrets_backup_confirmed=true \
  -e k8s_bootstrap_secrets_cleanup_confirmed=true

The two confirmations attest that you backed up openbao-admin-credentials and that the seed values are in OpenBao KV. Cleanup then deletes only the ephemeral seed Secrets. It keeps openbao-seal, which OpenBao needs on every restart.

With the backup in hand, remove the admin credential from the cluster as well:

kubectl -n openbao delete secret openbao-admin-credentials

Refer to OpenBao for the seal and admin-credential lifecycle.

Next Steps

For later configuration changes, follow Change GitOps-Managed Components.