About OpenBao
OpenBao is an open source secrets manager that started as a fork of HashiCorp Vault. It is managed under the Linux Foundation's OpenSSF and is developed by a community.
What it does
OpenBao stores secrets, certificates and keys, and it encrypts them before writing them to storage. It can create short-lived credentials for databases and Kubernetes on demand, then revoke them when the lease ends. Clients can renew leases through built-in APIs, and revocation can cover a whole tree of secrets, such as everything read by one user.
Key features
- Stores key-value secrets encrypted at rest
- Creates dynamic secrets for databases and Kubernetes
- Revokes secrets automatically when leases expire
- Encryption as a service with central key management
- Unified access control across different identities
Who it's for
OpenBao suits platform teams and security engineers who want a Vault-style secrets manager under an open license. Small teams with a handful of config files may only need environment-based secrets for now.
Pricing and good to know
OpenBao is released under the MPL-2.0 license and is free to use. Running it means you operate the server yourself, including backups, upgrades and high availability. The project's docs cover getting started and how to contribute, and the code is on GitHub.
Highlights
- Stores key-value secrets encrypted at rest
- Creates dynamic secrets for databases and Kubernetes
- Revokes secrets automatically when leases expire
- Encryption as a service with central key management
- Unified access control across different identities
