openbao: StatefulSet data PVC is orphaned after deletion #3058

Describe the bug

After deleting an OpenBAO app CR, the StatefulSet data PVC remains, consuming storage permanently.

Environment

• Cozystack version: v1.4.0-rc.2
• Provider: on-prem (bare-metal)

To Reproduce

1. Create a tenant, deploy OpenBAO/test.
2. Wait until Ready.
3. Delete the OpenBAO CR; wait ~120s.
4. kubectl -n <ns> get pvc — data-openbao-test-0 remains.

Expected behaviour
Data PVC is released (or explicitly cleaned) after the CR is deleted.

Actual behaviour

pvc/data-openbao-test-0   Bound

Additional context

• Root cause: OpenBAO app is a thin wrapper rendering a Flux HelmRelease (<release>-system) over the vendored upstream OpenBAO chart (packages/apps/openbao/templates/openbao.yaml:31-36, server.dataStorage). The PVC is the upstream StatefulSet volumeClaimTemplate. STS-templated PVCs are never deleted on STS deletion by design, and no persistentVolumeClaimRetentionPolicy is set.
• Proposed fix (one of):
  • (A) If the upstream chart supports it, pass through the HelmRelease values:

    server:
      dataStorage:
        persistentVolumeClaimRetentionPolicy: { whenDeleted: Delete }

  • (B) Add a post-delete PVC cleanup hook under packages/apps/openbao/templates/hooks/, selecting app.kubernetes.io/instance={{ .Release.Name }}.
  • The vendored upstream STS template must not be edited directly (AGENTS.md).

Found during a create→delete leak sweep of all 22 apps on Cozystack v1.4.0-rc.2.