Installation Manual - 63 Vault post-promotion soak cleanup plan

Post-promotion Vault R1 soak results and cleanup plan for the unused vault-platform store.

This chapter records the read-only post-promotion soak after vault.v7.comptech-lab.com was promoted from the old locked Vault to replacement Vault R1.

Governance

Validation Summary

Access path:

local coordinator -> dl385-2 -> gf-ocp-bootstrap-01 -> v7 kubeconfigs

Stable DNS still resolves to R1:

vault.v7.comptech-lab.com -> 30.30.200.35, 30.30.200.36, 30.30.200.37

Resolution was confirmed from:

• dl385-2
• gf-ocp-bootstrap-01
• hub ESO controller pod
• spoke ESO controller pod

Explicit Vault health checks:

OpenShift state:

Active ExternalSecrets remain Ready / SecretSynced:

OADP remains healthy:

StackRox remained acceptable on hub and spoke.

Finding

The unused ClusterSecretStore/vault-platform is now invalid on both clusters:

hub-dc-v7:   vault-platform Ready=False / InvalidProviderConfig
spoke-dc-v7: vault-platform Ready=False / InvalidProviderConfig

Argo CD is therefore Synced/Degraded for the applications that own that object:

hub-dc-v7-bootstrap
spoke-dc-v7-cluster-config

This is not an active secret delivery outage. No live ExternalSecret and no GitOps-managed ExternalSecret references vault-platform.

Likely cause:

• vault-platform still has the old Vault CA bundle.
• vault.v7.comptech-lab.com now resolves to R1.
• The R1 serving certificate is issued by the R1 CA.
• The R1 serving certificate includes vault-r1.v7.comptech-lab.com and 30.30.200.35, but not vault.v7.comptech-lab.com.

Cleanup Inventory

DNS:

VM state on dl385-2:

Recommended Next Gate

Remove the unused ClusterSecretStore/vault-platform resources from hub/spoke GitOps:

• clusters/hub-dc-v7/secrets/eso/clustersecretstore-vault.yaml
• clusters/spoke-dc-v7/secrets/eso/clustersecretstore-vault.yaml

Then validate:

• hub and spoke overlays render;
• server-side dry-run accepts both overlays;
• Argo returns to Synced/Healthy;
• active R1 stores remain Ready / Valid;
• active ExternalSecrets remain Ready / SecretSynced;
• OADP and RHACS remain healthy.

This is lower risk than rotating the R1 serving certificate because no active consumer uses vault-platform.

Do not decommission old Vault VMs yet. Keep old node-specific DNS records until the Argo degradation is cleared and at least one more scheduled backup window remains healthy.

Actions Not Taken

• No Vault secret, policy, auth role, auth mount, or token was changed.
• No DNS record was changed.
• No VM was stopped or modified.
• No GitOps desired state was changed in this gate.
• No secret values were printed.