[devantler]

🤖 Generated by the Agentic Engineer

Why

OpenBao's audit storage needs more headroom without losing evidence or interrupting the secrets service.

What

Adds a protected, manual recovery that expands only the three audit volumes within the approved size and cost limits, and verifies preservation and service health.

Deferred: #4671 — archival and long-term audit retention.

Fixes #4820

Part of #4671

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[devantler]

🤖 Generated by the Agentic Engineer

Pre-submission correctness, security and simplification review completed at 0e8fcab. The operation is manual, prod-protected and serialized; it changes only the three fixed audit storage requests after live source, deployment, price and reciprocal-binding checks. No audit content, credentials or raw telemetry is logged.

Regression-first controls reproduced and then closed false-success paths for ambiguous resize status, changed annotations, unexpected backing capacity, incomplete consumption receipts, ambiguous pod ownership/mounts and a price that changes before the next patch. Conflict and ambiguous-write controls stop without mutation replay. The actual kubectl transport control verifies the exact UID/resource-version preconditions and one bounded storage patch against an anonymous loopback API; this is not a production resize proof.

Local validation: complete go test ./... passed; required native-control race tests passed; affected Go lint reports zero issues; actionlint passed for both workflows; all ten Kustomize layers built, and both providers retain the original 1Gi claim template. Current-main recovery behavior and wiring controls passed. No production expansion has run.

This pre-submission review does not satisfy the external/current-head green-review gate. Review and CI remain required before merge and protected execution.

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 25 minutes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 24 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e5daeef3-7978-4656-953e-8e8ebef24558

📥 Commits

Reviewing files that changed from the base of the PR and between 569abf1 and 0e8fcab.

📒 Files selected for processing (10)

• .github/workflows/ci.yaml
• .github/workflows/expand-openbao-audit.yaml
• docs/operations/openbao-audit-capacity.md
• k8s/bases/infrastructure/controllers/openbao/helm-release.yaml
• scripts/expand-openbao-audit/main.go
• scripts/expand-openbao-audit/main_test.go
• scripts/expand-openbao-audit/native_test.go
• scripts/expand-openbao-audit/price.go
• scripts/expand-openbao-audit/price_test.go
• scripts/expand-openbao-audit/workflow_test.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: 0e8fcab

• CodeRabbit: current-PR included OSS review quota refusal at 2026-10-13T06:16:09Z, freshly verified at decision time; reset at 06:40:09Z. Source: #4822 (comment)
• Codex: account code-review usage limit since 2026-10-13T04:51:45Z, freshly verified; recovery requires account credit/settings changes, not a new request. Source: devantler-tech/monorepo#4147 (comment)
• Cursor Bugbot: user/team usage or spend limit since 2026-10-13T04:52:45Z, freshly verified; recovery requires admin action. Source: devantler-tech/monorepo#4147 (comment)

Separate current-head review completed over correctness, authorization, credential egress, price arithmetic, consumed-operation behavior, storage preservation and native transport controls. The protected lane permits only three fixed audit claim request increases; original claims, backing bindings, workload specifications and audit data are not deleted or recreated. The full-target gross-price calculation is stricter than the approved incremental cap, and is rechecked immediately before each patch. Unknown evidence, identity changes, cost changes, conflicts and ambiguous responses stop without retrying writes.

Reviewed direct current-PR review objects, conversation comments, complete threads and Bugbot checks: no substantive review or open finding is present. Required native controls execute real kubectl against an anonymous loopback API, not production. Complete root regression tests and affected race, lint, workflow and layer-build validation passed. Production execution and post-resize proof remain separate, after CI and merge.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

CI 38355646132 at source 0e8fcab failed only because the disruption-budget guard could not download the unchanged snapshot-controller 5.3.0 chart: the GitHub release asset returned HTTP 504 after all three bounded attempts. The guard correctly returned cannot-check rather than inventing a passing selector result. Required native audit transport/preservation tests and the other static gates passed.

The exact release asset is now serving HTTP 200 (24,274 bytes). Re-run only the failed jobs once, at the same source head; do not skip the selector guard, add a selector exception or change the chart/version. The required aggregate must pass with the real selector proof before promotion.

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at source 0e8fcab: CI 38355646132 is successful after the one diagnosed failed-job retry. All 30 disruption budgets were evaluated against the actual renders; the unchanged snapshot-controller selector now passes. Native transport and adversarial preservation/budget controls passed, with the existing immutable audit templates unchanged.

Green review: self@0e8fcab2ff9de84c7c75cb36e708f10d69a592a5, formal review5499542112, performed when all three provider limits were separately verified. Fresh complete thread read has zero unresolved threads, conversation/review reads contain no unaddressed finding, no conflict exists and the worktree holder is self. GitHub reports CLEAN at this head. Readable required gates must all pass; code-quality analysis has no readable head API and is enforced by GitHub's configured rule, not asserted manually.

User evaluation exercised the real kubectl command and exact patch transport with anonymous loopback positive/conflict controls, plus complete operation safety regressions. Live OIDC readback confirms the existing three audit claims Bound at10Gi and OpenBao3/3Ready, and captures the untouched database/snapshot identities. This does not claim a completed real CSI filesystem resize or live unsealed-service execution: that is the approved protected operation after merge, with separate source/deployment, price, health and preservation checks. No local production exec or mutation was used.

The user explicitly approved only these three audit volumes to20Gi, with additional cost at mostEUR5/month. Queue validation, successful deployment, approved protected execution and two separated live readbacks remain delivery stages, not facts inferred from this promotion.