What is OpenBao?
OpenBao is an open source, community-driven secrets manager and fork of Vault, managed by the Linux Foundation's OpenSSF. Its stated mission is to maintain and improve a software solution to manage, store and distribute sensitive data including secrets, certificates and keys, under an OSI-approved open-source license and open governance. The project's FAQ refers to the existing MPL 2.0 licensed code that it started from.
OpenBao stores arbitrary key/value secrets, encrypting them before writing to persistent storage. It can generate secrets on demand for some systems, such as Kubernetes or SQL databases, and revoke them when the lease ends. It also offers encryption as a service with centralized key management, and a unified ACL system that brokers access to systems and secrets and merges identities across providers.
The project lists sponsors and contributors including Adfinis, ControlPlane and Blendbyte, which sponsors the RPM and DEB package repository. Because it is free software with no vendor price list, cost comes from running and operating it yourself.
Key capabilities
- Secure secret storage Key/value secrets encrypted before they reach storage.
- Dynamic secrets Secrets generated on demand and revoked after the lease.
- Encryption as a service Centralized key management for data in transit and at rest.
- Identity-based access A unified ACL system across providers.
- Leasing and revocation Renewable leases and revocation of single secrets or whole trees of secrets.
Where OpenBao fits
- Secret storage for credentials and keys Arbitrary key/value secrets are encrypted before they are written to persistent storage.
- Dynamic, short-lived credentials OpenBao can generate secrets on demand for systems such as Kubernetes or SQL databases and revoke them after the lease is up.
- Encryption as a service Centralized key management simplifies encrypting data in transit and stored across clouds and datacenters.
- Identity-based access policies A unified ACL system brokers access to systems and secrets and merges identities across providers.
- Lease management Every secret has a lease, and clients can renew leases through built-in renew APIs.
- Secret revocation OpenBao can revoke a single secret or a tree of secrets, such as all secrets read by a specific user.
- Client validation Clients are validated against a trusted source such as GitHub, LDAP or AppRole before access is granted.
Reviews of OpenBao
Be the first to share your experience with OpenBao.
Write a review
Loading review form…
