Installation Manual - 74 Vault replacement phase closeout

Final read-only closeout for the v7 Vault replacement phase after R1 cutover, backup proof, old VM deletion, and stale DNS cleanup.

This chapter records the final read-only closeout for the greenfield v7 Vault replacement phase.

The phase replaced a lost-custody Vault deployment with a new R1 Vault path, migrated OpenShift consumers, proved backup and restore behavior, removed the old VM and disk footprint, and cleaned up the final stale DNS record.

Governance

Final State

Replacement R1 Vault remains the active Vault path for greenfield OpenShift consumers.

Final Read-Only Validation

Libvirt validation from dl385-2:

R1 VM state:

Vault health:

DNS validation:

PowerDNS authoritative zone contains only the stable Vault R1 records for Vault access and reports SOA serial 45.

OpenShift Validation

Cluster health:

Argo CD:

External Secrets:

R1-backed ClusterSecretStores remained Ready/Valid on both clusters:

• vault-r1-eso-smoke;
• vault-r1-oadp;
• vault-r1-rhacs.

Vault egress policies allow only R1 Vault CIDRs:

30.30.200.35/32
30.30.200.36/32
30.30.200.37/32

OADP:

RHACS:

• hub Central reported Available;
• no non-running StackRox pods were found on hub or spoke.

Phase Summary

The completed Vault replacement phase included:

• accepted ADR and GitHub issue governance;
• replacement R1 VM allocation;
• R1 Vault build and custody creation;
• Kubernetes auth and smoke read validation for hub/spoke;
• dedicated OADP, ESO smoke, and RHACS replacement stores;
• MinIO OADP credential rotation and seeding into R1 Vault;
• OADP DPA validation;
• ad hoc backup validation;
• scheduled backup enablement and proof;
• restore drill;
• stable Vault DNS promotion;
• removal of the unused vault-platform store;
• post-cleanup scheduled backup proof;
• old Vault retirement readiness;
• removal of old Vault egress CIDRs;
• old VM power-off;
• cold retention soak;
• post-power-off backup proof;
• deletion of old VM definitions and disk images;
• stale old seed DNS cleanup.

Result

The greenfield v7 Vault replacement phase is complete.

The active OpenShift consumers use replacement R1 Vault paths, backup and restore behavior has been proven, and the old lost-custody Vault VM, disk, and DNS footprint is removed from active infrastructure.

Issue #389 was closed after the final read-only validation passed.