OpenBao: The open source secrets manager

Our core team created Vault at HashiCorp, operationalised it at GitLab, and has deployed it at the world's biggest tier 1 banks.

What is OpenBao?

OpenBao exists to maintain and improve a software solution for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. The OpenBao community will provide this software under an OSI-approved open-source license, led by a community run under open governance principles.

Learn more at openbao.org.

Core capabilities

Secure Secret Storage. Arbitrary key/value secrets can be stored in OpenBao. OpenBao encrypts these secrets before writing them to persistent storage, so gaining access to the raw storage is not enough to access them.

Dynamic Secrets. OpenBao can generate secrets on demand for some systems, such as Kubernetes or SQL databases. OpenBao will automatically revoke them when the lease expires.

Data Encryption. OpenBao provides encryption as a service with centralised key management to simplify encrypting data in transit and at rest across clouds and data centres.

Identity-based access. Organisations need a way to manage identity sprawl across different clouds, services, and systems. OpenBao solves this challenge by using a unified ACL system to broker access to systems and secrets, and to merge identities across providers.

Leasing and Renewal. All secrets in OpenBao have a lease. At the end of the lease, OpenBao will automatically revoke that secret. Clients can renew leases via built-in renewal APIs.

Revocation. OpenBao has built-in support for secret revocation. OpenBao can revoke not only single secrets, but a tree of secrets, for example, all secrets read by a specific user, or all secrets of a particular type.

Enterprise for OpenBao

Learn more about Enterprise for OpenBao which includes Enterprise Support.

Or talk to us, if you are curious about a migration assessment.

Hands-on tutorials