fix(openbao): improve install command

[Jcing95]

Summary

• Add --namespace / -n flag to oms install openbao to allow deploying OpenBao to a custom Kubernetes namespace (defaults to vault for backward compatibility)
• Fix multi-namespace support: the Bank-Vaults Operator is cluster-scoped, so skip re-deployment if it already exists in another namespace (prevents Helm ownership conflicts on ClusterRole resources)
• Ensure the target namespace is created before applying the Vault CR, since Helm no longer implicitly creates it when the operator lives elsewhere
• Fix unchecked os.Setenv return value flagged by the linter

[Copilot]

Pull request overview

This PR enhances the oms install openbao workflow to support deploying OpenBao into a configurable Kubernetes namespace while avoiding Helm ownership conflicts when the (cluster-scoped) Bank-Vaults Operator is already installed elsewhere. It also adjusts the install flow to create the target namespace explicitly, improves DR-restore handling of unseal keys, and introduces an interactive confirmation for destructive fresh initialization.

Changes:

• Add --namespace/-n, --age-key-file/-k, and --yes/-y flags to the CLI and document them.
• Update the OpenBao installer to be namespace-aware, skip operator redeploy when already present cluster-wide, ensure namespace creation before applying the Vault CR, and refine initialization/cleanup logic.
• Enable preFlightChecks: true in the Vault CR manifest and update installer tests accordingly.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
NOTICE	Fix jsonpatch/v2 license URL.
internal/tmpl/NOTICE	Keep NOTICE template in sync with corrected license URL.
internal/installer/openbao.go	Namespace-aware install flow, operator redeploy avoidance, DR restore secret handling, new pod readiness wait, expanded cleanup.
internal/installer/openbao_test.go	Update/add tests for new operator deployment behavior and manifest expectations.
internal/installer/manifests/openbao/vault-cr.yaml	Enable bank-vaults unseal preFlightChecks.
docs/oms_install_openbao.md	Document new CLI flags (--namespace, --age-key-file, --yes).
cli/cmd/install_openbao.go	Wire new flags, set SOPS key file env var, add destructive-operation confirmation prompt.

Comments suppressed due to low confidence (1)

internal/installer/openbao.go:618

• hasExistingDeployment lists PVCs in the target namespace. If the namespace doesn't exist yet (common for a new --namespace), the List call can return a NotFound error and currently bubbles up, aborting the install during the confirmation check. It should treat a NotFound namespace as “no existing deployment” and return (false, nil).

	// Vault CR gone but PVCs may linger (e.g. CR was manually deleted).
	pvcList, err := o.Clientset.CoreV1().PersistentVolumeClaims(o.Config.Namespace).List(
		o.ctx, metav1.ListOptions{LabelSelector: "vault_cr=openbao"},
	)
	if err != nil {
		return false, fmt.Errorf("listing PVCs: %w", err)
	}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.