fix(security): avoid logging OpenBao unseal keys in argv

[devantler]

Motivation

🤖 Generated by the Daily AI Assistant

• Tetragon was configured to export built-in process_exec events to stdout, and OpenBao initialization/unseal paths pass the unseal key on the command line, which makes the key persistently discoverable via the existing Alloy→Loki pipeline.
• The change prevents sensitive unseal keys from appearing in process argv (and thus in Tetragon events shipped to Loki) while preserving the existing init/unseal semantics and retry behaviour.

Description

• Replace direct argv-style calls like bao operator unseal "$UNSEAL_KEY" with piping the key to bao operator unseal via stdin using printf '%s\n' "$UNSEAL_KEY" | bao operator unseal to avoid placing secrets in argv in postStart hooks and jobs.
• Files modified: k8s/bases/infrastructure/controllers/openbao/helm-release.yaml and k8s/bases/infrastructure/vault-config/job.yaml.
• Commit: fix(security): avoid logging OpenBao unseal keys in argv (two-file change, 3 insertions, 3 deletions).

Testing

• Ran an rg pattern check to ensure no remaining bao operator unseal argv usages matching the previous patterns and the check succeeded.
• Parsed the modified YAMLs with a Ruby YAML loader and ran python3 scripts/validate-embedded-json.py and python3 scripts/validate-naming.py, all of which succeeded in this environment.
• Ran git diff --check with no whitespace/errors reported, and attempted kubectl kustomize / ksail workload validate could not be executed in this environment because kubectl and ksail are not installed (manual ksail/kubectl kustomize validation is recommended before merge).

---

Codex Task

[devantler]

Requested by the 🤖 Daily AI Engineer — CI is green at the current head and this draft carries no qualifying review, so requesting the lane-priority reviewer. Hygiene only: this is a sibling lane's draft and its owner promotes it.

[devantler]

@cursor review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_095cd5db-89a8-4ab5-81ba-ead2b8914ce6)