Implement Openbao unseal rotation (!5186) · Merge requests · GitLab.org / charts / GitLab Chart

Why this MR ?

Implements gitlab-org/gitlab#603143
Self-managed had no clean way to rotate the OpenBao unseal key - the chart mounted a single static key with no slot for the previous key
Rotating the static key and switching the awskms key were both undocumented

Add an optional previous key mount for static unseal so the old key runs alongside the new one during rotation, rendered only when config.unseal.static.previousKeyId is set
Make the unseal secret field names value driven with global.openbao.unseal.currentKeyField and previousKeyField, so rotation adds the new key under a new field instead of overwriting the current one
Gate the static unseal secret and mount on config.unseal.static.enabled so enabling awskms no longer leaves an orphaned static secret and mount
Add a gitlab.checkConfig.openbao.unseal check so a missing field name fails at render time instead of leaving a pod that cannot start
Document the static unseal key rotation procedure, a separate Geo procedure, and the AWS KMS rotation and key switch notes in the OpenBao chart docs
Storing a recovery key is now called out as a prerequisite for rotation - without one OpenBao skips the rewrap
No change for existing installs - default rendering is unchanged

Issue - gitlab-org/gitlab#603143
OpenBao chart MR that makes previousKeyId and previousKey fail unless both are set - gitlab-org/cloud-native/charts/openbao!74 (merged)

For general guidance, please follow our Contributing guide.

For anything in this list which will not be completed, please provide a reason in the MR discussion.

Merge Request Title and Description are up to date, accurate, and descriptive.
MR targeting the appropriate branch.
MR has a green pipeline.
Documentation created/updated.
Tests added/updated.
Have you validated that your change works end-to-end on a real cluster deployment?
- Describe how you did it in a comment.
Equivalent MR/issue for omnibus-gitlab opened.