Add OpenBao Monitoring

doc/source/configuration/openbao.rst

@@ -221,6 +221,35 @@ cannot be unsealed with an expired certificate.
 
       kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/secret-store/secret-store-unseal-overcloud.yml
 
+Monitoring
+----------
+
+OpenBao monitoring is enabled when ``stackhpc_ca_secret_store`` is set to
+``openbao`` and ``stackhpc_openbao_enabled`` is ``true``. When both conditions
+are met, ``stackhpc_enable_openbao_monitoring`` defaults to ``true``. This adds
+Prometheus scrape targets for the overcloud OpenBao instances, alerting for
+sealed or unhealthy OpenBao nodes, and an OpenBao Grafana dashboard.
+
+Existing deployments must rerun the overcloud secret store deployment playbook
+to expose metrics unauthenticated for Prometheus and set
+``stackhpc_openbao_enabled`` to ``true`` in ``stackhpc-monitoring.yml``:
+
+.. code-block:: bash
+
+   kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/secret-store/secret-store-deploy-overcloud.yml
+
+Then reconfigure Prometheus and Grafana:
+
+.. code-block:: bash
+
+   kayobe overcloud service reconfigure -kt prometheus,grafana
+
+To disable OpenBao monitoring, set:
+
+.. code-block:: yaml
+
+   stackhpc_enable_openbao_monitoring: false
+
 Certificates generation
 =======================
 

etc/kayobe/ansible/secret-store/secret-store-deploy-overcloud.yml

@@ -170,3 +170,23 @@
         vault_pki_certificates_directory: "{{ kayobe_env_config_path }}/{{ stackhpc_ca_secret_store }}"
       environment:
         https_proxy: ""
+
+- name: Update the OpenBao overcloud deployment state
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Mark OpenBao as deployed in Kayobe config
+      ansible.builtin.lineinfile:
+        path: "{{ kayobe_env_config_path }}/stackhpc-monitoring.yml"
+        regexp: "^stackhpc_openbao_enabled:"
+        line: "stackhpc_openbao_enabled: true"
+        create: true
+        mode: "0664"
+      register: openbao_deployment_config
+      when: stackhpc_ca_secret_store == "openbao"
+
+    - name: Remind the user to commit the deployment state change
+      ansible.builtin.debug:
+        msg: "OpenBao has been marked as deployed; commit the change to stackhpc-monitoring.yml."
+      when:
+        - openbao_deployment_config is changed