OpenBao Seal Status & Cluster Health Sentinel

id: openbao-seal-status-and-cluster-health-sentinel
namespace: company.security

description: "Continuously audits OpenBao open-source secret management cluster
  health, detects sealed server states, validates storage engine responsiveness,
  and alerts on secret resolution outages."

inputs:
  - id: openbao_host
    type: STRING
    defaults: "localhost"
    description: "Hostname or IP address of the OpenBao server or cluster load balancer."

  - id: openbao_port
    type: INT
    defaults: 8200
    description: "HTTP/HTTPS port for the OpenBao API (default: 8200)."

  - id: standby_ok
    type: BOOL
    defaults: true
    description: "When true, considers unsealed standby nodes in high-availability
      clusters as healthy."

  - id: slack_channel
    type: STRING
    defaults: "#security-alerts"
    description: "Target Slack channel for secret engine alerts and incident escalation."

triggers:
  - id: periodic_openbao_audit
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true

tasks:
  - id: probe_sys_health
    type: io.kestra.plugin.core.http.Request
    description: "Queries the OpenBao /v1/sys/health endpoint to evaluate
      initialization state, seal status, and cluster role."
    uri: "http://{{ inputs.openbao_host }}:{{ inputs.openbao_port
      }}/v1/sys/health?standbyok={{ inputs.standby_ok }}"
    method: GET
    options:
      allowFailed: true
      timeout:
        readIdleTimeout: PT15S

  - id: classify_seal_and_health_state
    type: io.kestra.plugin.core.flow.Switch
    description: "Evaluates HTTP status code and response payload to classify
      OpenBao cluster state into OPENBAO_SEALED, UNINITIALIZED,
      ENDPOINT_UNREACHABLE, or HEALTHY."
    value: >-
      {% if outputs.probe_sys_health.code == 503 or
      (outputs.probe_sys_health.body is defined and
      outputs.probe_sys_health.body.sealed is defined and
      outputs.probe_sys_health.body.sealed == true) %}
        OPENBAO_SEALED
      {% elseif outputs.probe_sys_health.code == 501 or
      (outputs.probe_sys_health.body is defined and
      outputs.probe_sys_health.body.initialized is defined and
      outputs.probe_sys_health.body.initialized == false) %}
        UNINITIALIZED
      {% elseif outputs.probe_sys_health.code != 200 and
      outputs.probe_sys_health.code != 429 %}
        ENDPOINT_UNREACHABLE
      {% else %}
        HEALTHY
      {% endif %}
    cases:
      OPENBAO_SEALED:
        - id: alert_openbao_sealed
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Dispatches emergency incident notification when an OpenBao server
            node enters a sealed state, preventing secret decryption."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "[CRITICAL] OpenBao Secret Engine is SEALED",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "[ALERT] OpenBao Secret Engine Sealed"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Target Host:*\n`{{ inputs.openbao_host }}:{{ inputs.openbao_port }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*HTTP Status:*\n`{{ outputs.probe_sys_health.code }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Seal Status:*\n`SEALED (Keys Encrypted)`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Severity:*\n`CRITICAL`"
                    }
                  ]
                },
                {
                  "type": "context",
                  "elements": [
                    {
                      "type": "mrkdwn",
                      "text": "Immediate action required: Execute unseal key ceremony via 'bao operator unseal' or verify auto-unseal KMS credentials."
                    }
                  ]
                }
              ]
            }

        - id: fail_on_sealed
          type: io.kestra.plugin.core.execution.Fail
          description: "Fails the workflow execution to record an SLA violation."

      UNINITIALIZED:
        - id: alert_uninitialized
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Alerts security teams when an OpenBao node reports uninitialized
            state."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "[CRITICAL] OpenBao Cluster Node is Uninitialized",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "[ALERT] OpenBao Node Uninitialized"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Target Host:*\n`{{ inputs.openbao_host }}:{{ inputs.openbao_port }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*HTTP Status:*\n`{{ outputs.probe_sys_health.code }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*State:*\n`NOT_INITIALIZED`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Severity:*\n`HIGH`"
                    }
                  ]
                },
                {
                  "type": "context",
                  "elements": [
                    {
                      "type": "mrkdwn",
                      "text": "Action required: Run 'bao operator init' or check Raft storage cluster joining logs."
                    }
                  ]
                }
              ]
            }

        - id: fail_on_uninitialized
          type: io.kestra.plugin.core.execution.Fail
          description: "Fails the workflow execution to enforce initialization checks."

      ENDPOINT_UNREACHABLE:
        - id: alert_unreachable
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Dispatches critical notification when OpenBao server endpoint is
            offline or returning HTTP server errors."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "[CRITICAL] OpenBao Server Endpoint Unreachable",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "[ALERT] OpenBao Endpoint Offline"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Target Host:*\n`{{ inputs.openbao_host }}:{{ inputs.openbao_port }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*HTTP Status:*\n`{{ outputs.probe_sys_health.code }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Execution ID:*\n`{{ execution.id }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Timestamp:*\n`{{ now() }}`"
                    }
                  ]
                },
                {
                  "type": "context",
                  "elements": [
                    {
                      "type": "mrkdwn",
                      "text": "Immediate action required: Check OpenBao systemd service, container runtime, and ingress proxy."
                    }
                  ]
                }
              ]
            }

        - id: fail_on_unreachable
          type: io.kestra.plugin.core.execution.Fail
          description: "Fails the execution on endpoint unreachable."

      HEALTHY:
        - id: log_cluster_healthy
          type: io.kestra.plugin.core.log.Log
          description: "Records nominal cluster state when OpenBao is unsealed,
            initialized, and responsive."
          message: "[OK] OpenBao cluster at {{ inputs.openbao_host }}:{{
            inputs.openbao_port }} is unsealed and operational. Version: {{
            outputs.probe_sys_health.body.version ?? 'verified' }}. Server time:
            {{ outputs.probe_sys_health.body.server_time_utc ?? now() }}."

  - id: audit_sentinel_run
    type: io.kestra.plugin.core.log.Log
    description: "Final audit log summarizing execution metrics and verified secret
      engine state."
    message: "[AUDIT] OpenBao sentinel completed execution {{ execution.id }}.
      Target host: {{ inputs.openbao_host }}:{{ inputs.openbao_port }}. Sealed:
      {{ outputs.probe_sys_health.body.sealed ?? 'unknown' }}. Version: {{
      outputs.probe_sys_health.body.version ?? 'N/A' }}."

OpenBao is the Linux Foundation open-source, community-governed identity-based secret management and encryption platform. Widely deployed across cloud-native environments, OpenBao manages database credentials, API tokens, cryptographic certificates, and transit encryption keys for modern container workloads and automated delivery pipelines.

In production operations, OpenBao instances initialize in a locked, encrypted state known as Sealed. Following unexpected node reboots, container restarts, or Raft storage quorum failovers, an unsealed node automatically re-seals if auto-unseal mechanisms fail. While sealed, all secret access operations fail immediately, causing cascading outages across applications that depend on dynamic secret retrieval. This blueprint implements an automated Sentinel that audits OpenBao health, detects sealed states in real time, and alerts on-call teams via Slack before application failures propagate.

How it works

Scheduled Audit Trigger: Runs on a configurable 15-minute interval (*/15 * * * *), disabled by default for controlled onboarding and ad-hoc manual validation.
Health Probe Request: Dispatches an HTTP GET request to /v1/sys/health with allowFailed: true and configurable standbyok parameters, capturing status codes and JSON cluster metadata.
State Classification: Evaluates HTTP response codes and payload attributes within a flow-control Switch task, routing executions into OPENBAO_SEALED (HTTP 503), UNINITIALIZED (HTTP 501), ENDPOINT_UNREACHABLE, or HEALTHY (HTTP 200/429) pathways.
Slack Incident Alerting: Issues structured incident notifications via io.kestra.plugin.slack.notifications.SlackIncomingWebhook containing target host coordinates, HTTP status, and operational unseal runbooks.
Deterministic Failure & Audit: Terminates degraded executions with io.kestra.plugin.core.execution.Fail to enforce SLA tracking, and emits a final audit log capturing execution telemetry.

What you get

Instant Seal Detection: Immediate alerting when an OpenBao server node reboots into a sealed state, preventing prolonged secret downtime.
Initialization & Unreachable Tracking: Detects uninitialized cluster members or unresponsive daemon processes across ingress boundaries.
Triage-Ready Slack Notifications: Formatted alerts delivering exact host coordinates, HTTP response codes, and actionable unseal instructions.
Declarative Security Observability: Replaces fragile shell scripts and custom sidecars with auditable, version-controlled YAML.

Who it's for

Security & DevSecOps Engineers: Managing centralized secret management clusters, dynamic credentials, and PKI engines.
Platform & Infrastructure Teams: Responsible for secret store availability, Raft storage quorum, and zero-trust authentication pipelines.
Site Reliability Engineers: Monitoring critical path infrastructure dependencies across production Kubernetes clusters.

Why orchestrate this with Kestra

Resilient Error Handling: Uses allowFailed: true to inspect non-200 HTTP responses without prematurely terminating the workflow.
Stateful Flow Branching: Classifies complex JSON responses with Pebble expressions without requiring bespoke monitoring microservices.
Dynamic Secret Protection: Protects Slack webhook URLs and administrative tokens using native namespace secret management.
Auditable History: Maintains an immutable execution log of every health check for SOC 2 and security compliance reviews.

Prerequisites

A running OpenBao server instance with network accessibility from the Kestra worker.
Network connectivity to the OpenBao API port (8200).
An incoming webhook URL configured in your target Slack workspace.

Secrets

SLACK_WEBHOOK_URL: Target Slack incoming webhook URL for operational alerts and incident escalation (required).

Quick start

Configure the SLACK_WEBHOOK_URL secret in your Kestra namespace settings.
Start a local OpenBao container in dev mode for testing: docker run -d --name openbao -p 8200:8200 -e 'BAO_DEV_ROOT_TOKEN_ID=root' openbao/openbao:latest server -dev -dev-listen-address=0.0.0.0:8200.
Import this blueprint into Kestra and trigger an execution with default inputs.
Confirm that the health probe succeeds and verify the nominal status in the Kestra UI execution logs.
Enable the schedule trigger to establish automated 15-minute continuous monitoring.

How to extend

Automated Unseal Trigger: Add tasks to invoke cloud KMS or unseal key orchestration when a sealed node is detected.
Raft Peer Verification: Chain additional HTTP requests to /v1/sys/storage/raft/configuration to verify cluster peer voting health.
PagerDuty Escalation: Add io.kestra.plugin.pagerduty.notifications.PagerDutyAlert for high-severity sealed outage events.

OpenBao Seal Status and Cluster Health Sentinel

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

OpenBao Seal Status and Cluster Health Sentinel

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

Netdata Node Health and System Alarm Sentinel

NetBox Drift Reconciliation with GitHub Audit Trail

Run Ansible Against NetBox Devices by Role and Site

Netlify Deploy Failure Sentinel

Provision a VM and Register It in NetBox

Audit NetworkPolicy Coverage Across Every Namespace

New to Kestra?