---
credentials:
seal_key:
description: 32-byte AES-256-GCM-96 key for the OpenBao static seal, injected as env://OPENBAO_SEAL_KEY. Every backup of the raft volume is undecryptable
without it; its authoritative home is the encrypted inventory. Pinned because the static seal carries only one generation, so a deploy that skips a
generation, or dies between the two AppRole pins, puts the store outside that window and leaves it recoverable only from a volume backup plus the key that
wraps it. Rotate it deliberately by changing the inventory value; openbao.hcl.j2 still renders the previous_key pair for that.
algorithm: random_hex_32
validation: non_empty_string
rotatable: false
approle_role_id:
description: RoleID of the Ansible AppRole, written to auth/approle/role/ansible/role-id at bootstrap so later deploys authenticate without a stored root
token.
algorithm: alphanumeric
validation: non_empty_string
approle_secret_id:
description: SecretID of the Ansible AppRole, written to auth/approle/role/ansible/custom-secret-id at bootstrap.
algorithm: alphanumeric
validation: non_empty_string
