From d65da84d2a2e6ea064050199c6b0bd50f9302609 Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Fri, 25 Sep 2026 20:33:16 +0000
Subject: [PATCH] =?UTF-8?q?=E9=80=82=E9=85=8D=20Bao=20=E7=BB=AD=E6=9C=9F?=
 =?UTF-8?q?=E5=91=BD=E4=BB=A4=E5=B9=B6=E7=BA=B3=E5=85=A5=E5=B7=B2=E9=AA=8C?=
 =?UTF-8?q?=E8=AF=81=E7=9A=84=E7=9B=91=E6=8E=A7=E8=BA=AB=E4=BB=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../openbao_bootstrap/templates/bao-snapshot.sh.j2    |  2 +-
 infrastructure/openbao/terraform/imports.tf           | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/bao-snapshot.sh.j2 b/infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/bao-snapshot.sh.j2
index e7294ac..a8a48ff 100644
--- a/infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/bao-snapshot.sh.j2
+++ b/infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/bao-snapshot.sh.j2
@@ -11,7 +11,7 @@ BAO_TOKEN="$(cat /etc/openbao/snapshot.token)"
 export BAO_TOKEN
 
 # periodic token 不会自动续期；在每日快照前续期，避免 768h 后永久失败。
-bao token renew -self >/dev/null
+bao token renew >/dev/null
 
 dir="{{ openbao_snapshot_dir }}"
 stamp="$(date +%Y%m%d-%H%M%S)"
diff --git a/infrastructure/openbao/terraform/imports.tf b/infrastructure/openbao/terraform/imports.tf
index 5fc440a..5795d99 100644
--- a/infrastructure/openbao/terraform/imports.tf
+++ b/infrastructure/openbao/terraform/imports.tf
@@ -68,3 +68,14 @@ import {
   to = vault_pki_secret_backend_config_urls.this
   id = "pki/config/urls"
 }
+
+# 本次维护预检先通过同名 API 配置验证，后续 Terraform 纳入既有主 state。
+import {
+  to = vault_policy.metrics
+  id = "metrics"
+}
+
+import {
+  to = vault_kubernetes_auth_backend_role.metrics
+  id = "auth/kubernetes/role/metrics"
+}