Recovery drill: OpenBao

Use scripts/restore-openbao.sh (see Platform recovery rehearsals). There is no same-instance mode: the script always creates a one-node throwaway in a restore-* namespace and uses the fresh-node snapshot-force API.

Prepare​

Export (never print) the original unseal material and root token:

• BAO_UNSEAL_KEY_1, BAO_UNSEAL_KEY_2, BAO_UNSEAL_KEY_3
• BAO_ROOT_TOKEN

Also retain the age key that decrypts the transport-wrapped snapshot. Choose --verify-path for a known tenants path, e.g. tenants/data/….

DRY_RUN​

cd /path/to/bex
DRY_RUN=1 scripts/restore-openbao.sh \
  --target-namespace restore-bao-drill \
  --verify-path tenants/data/example \
  --snapshot latest

Restore​

scripts/restore-openbao.sh \
  --target-namespace restore-bao-drill \
  --verify-path tenants/data/example \
  --snapshot latest \
  --confirm restore-bao-drill \
  --teardown-on-success

Verify and clean up​

The script unseals the throwaway with the provided keys and checks --verify-path. If you omitted teardown-on-success:

scripts/restore-openbao.sh --teardown restore-bao-drill --confirm restore-bao-drill