Add OpenBao Monitoring

[technowhizz]

To be merged after stackhpc/ansible-collection-hashicorp#93 merges and then bumping the requirements.yml for the collection

[gemini-code-assist]

Code Review

This pull request introduces monitoring support for OpenBao, including Prometheus scrape configurations, alerting rules for sealed or unhealthy nodes, and corresponding documentation. A critical issue was identified in the Prometheus scrape configuration template, where the Kayobe-specific inventory group 'controllers' and filter 'net_ip' were used instead of Kolla-native equivalents ('control' group and 'kolla_address' filter), which would cause template rendering failures.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[technowhizz]

Hmm CI is failing because the prometheus scrape job is enabled by default (assuming most clients have openbao deployed) but because we manually have to deploy openbao, it's not set up in the CI and so there is a prometheus alert for exporter down.

Should we have it disabled by default and get the deploy openbao playbook to change some var to enable it?

@jovial @dougszumski What do you think?

[jovial]

Hmm CI is failing because the prometheus scrape job is enabled by default (assuming most clients have openbao deployed) but because we manually have to deploy openbao, it's not set up in the CI and so there is a prometheus alert for exporter down.

Should we have it disabled by default and get the deploy openbao playbook to change some var to enable it?

@jovial @dougszumski What do you think?

Not a bad idea. I think a lot of people bring up the cloud without TLS and then enable it. I agree its better to start with it being set to false and then we can work out the best way to "enable it out the box". Potentially, you could use a custom fact:

https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_vars_facts.html#adding-custom-facts

That you can then use in templating.

[technowhizz]

@jovial Thanks for taking a look.

Is there native custom fact support in kayobe?

[coderabbitai]

Warning

Review limit reached

@technowhizz, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9b1f453f-52e2-4261-b2ed-06f7807fa4dd

📥 Commits

Reviewing files that changed from the base of the PR and between bf2614a and afea7ca.

📒 Files selected for processing (7)

• doc/source/configuration/openbao.rst
• etc/kayobe/ansible/secret-store/secret-store-deploy-overcloud.yml
• etc/kayobe/kolla/config/grafana/dashboards/openstack/openbao.json
• etc/kayobe/kolla/config/prometheus/openbao.rules
• etc/kayobe/kolla/config/prometheus/prometheus.yml.d/50-openbao.yml
• etc/kayobe/stackhpc-monitoring.yml
• releasenotes/notes/add-openbao-monitoring-alerts-1c0837df41c80459.yaml

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch openbao-monitoring

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}