Installation Manual - 70 Old Vault cold-retention soak

Read-only cold-retention validation after the old lost-custody Vault VMs were powered off.

This chapter records the first cold-retention soak checkpoint after the old lost-custody v7 Vault VMs were powered off.

No VM was started. No disk image was deleted. No DNS, GitOps, OpenShift, Vault R1, or MinIO state was changed.

Governance

Validation Boundary

The checkpoint validated the current cold-retention state:

• old Vault VMs remained powered off;
• old Vault autostart remained disabled;
• old Vault disk images remained retained;
• replacement Vault R1 remained running;
• stable Vault DNS still resolved to R1;
• active OpenShift consumers remained healthy on R1-backed stores;
• OADP, RHACS, nodes, and ClusterOperators remained healthy.

This checkpoint did not observe a new scheduled backup after old Vault VM power-off. The latest normal scheduled backups completed before the power-off gate and were rechecked as still Completed. A later post-power-off backup window remains the next checkpoint before any disk-retention decision.

VM State

Old disk images remained present under /var/lib/libvirt/images/.

DNS And Vault Health

DNS remained unchanged:

PowerDNS zone serial remained 44.

Old Vault direct health remained unreachable after power-off:

Replacement Vault R1 health was healthy with standby-ok enabled:

OpenShift Validation

Both clusters remained on OpenShift 4.20.18.

Argo CD:

The hub-side wrapper remained Progressing, but the managed-cluster report showed the spoke application healthy:

clusters=1 synced=1 healthy=1 inProgress=0 notHealthy=0 notSynced=0

External Secrets stores:

ExternalSecrets:

Vault egress policies continued to allow only R1 Vault CIDRs:

30.30.200.35/32
30.30.200.36/32
30.30.200.37/32

OADP Validation

OADP remained healthy:

Latest normal scheduled backups were rechecked:

These backups completed before the old VM power-off. The next checkpoint should observe or intentionally accelerate a new backup window while old Vault VMs remain off.

RHACS Validation

• Hub Central remained deployed.
• No non-running StackRox pods were found on hub or spoke.

Result

The first cold-retention checkpoint passed.

Replacement Vault R1 remained healthy, active OpenShift consumers remained healthy, and the old lost-custody Vault VMs stayed powered off with old disks retained.

The next gate should validate a post-power-off OADP backup window before any final retention decision about old Vault VM disk images.