OpenBAO: can't init/unseal without kubectl exec #2483

OpenBAO uses Shamir seal, so it needs manual init and unseal. The problem is that sealed pods fail the readiness probe, which means Kubernetes pulls them out of Service endpoints. This creates a catch-22:

• You need network access to unseal the pod
• But the pod won't get network access (via Service) until it's unsealed

Even with external: true, the LoadBalancer has zero backends — there's nothing to connect to. The only workaround right now is kubectl exec or kubectl port-forward directly to the pod.

It gets worse with 3 replicas: each pod needs to be unsealed individually, and a single Service can't target specific pods. On top of that, every pod restart re-seals the instance, so this isn't a one-time setup — it's an ongoing need for cluster admin intervention.

Right now OpenBAO can't really work as a self-service tenant app without cluster admin help.

Related: #1942 discusses replacing Helm lookups with a system-level OpenBao + ESO architecture, where the unseal strategy is one of the open questions. The system-wide vs per-tenant question was also raised in #2059 but left unresolved.

Ideas

• Fix the readiness probe so sealed/uninitialized pods still receive traffic
• Expose per-pod Services for targeted unseal
• Add init/unseal to the dashboard
• Look into auto-unseal (transit seal or similar)