fix: [alert] OpenBaoQuorumLost (openbao) (#920)

Reviewed-on: k.renner/homelab#919

kubernetes/apps/monitoring-rules/prometheusrule-openbao.yaml

@@ -57,10 +57,14 @@ spec:
           # the ClusterSecretStore goes InvalidProviderConfig and no
           # ExternalSecret can refresh.
           #
-          # No window: below quorum the secret store is down and every
-          # ExternalSecret stalls with it, so waiting only delays the page.
+          # Short window: readiness is only a proxy for quorum. A one-second
+          # node NotReady flap makes the node lifecycle controller mark that
+          # node's pods not-ready for ~30s while raft keeps its leader and
+          # serves (issue #920, during a rolling reboot with one replica
+          # already evicted). A really sealed or crashed majority persists,
+          # and existing Secrets keep their last values, so 2m costs little.
           expr: max by (namespace, statefulset) (kube_statefulset_status_replicas_ready{namespace="openbao", statefulset="openbao"}) < 2
-          for: 0m
+          for: 2m
           labels:
             severity: critical
           annotations:

kubernetes/infrastructure/bird/bird.conf

@@ -23,7 +23,7 @@ protocol device { scan time 10; }
 # down. The usual advice is not to export these to the kernel because it
 # maintains them itself — true of main, not of a table the kernel never fills.
 protocol direct attached {
-  interface "mgmt0", "ingress0", "pod0";
+  interface "mgmt0", "ingress0", "pod0", "node0";
   ipv4 { table master4; };
   ipv6 { table master6; };
 }