Who openbao is for#
DevOps teams migrating off HashiCorp Vault Enterprise
OpenBao preserves the Vault API and ships from the same MPL-2.0 codebase, so existing Vault configurations, Terraform providers, and client libraries work without code changes. Teams that froze on the last OSS Vault release to avoid BSL licensing can move to an actively maintained fork with a clear governance path.
Skip if:
If your team depends on Vault Enterprise features like HSM integration, Vault Secrets Operator, or specific enterprise plugins, verify those are available in OpenBao before migrating.
Platform engineers standardizing secrets management
Dynamic credentials eliminate long-lived static secrets from application config. OpenBao's unified ACL system lets platform teams define access policies once and apply them across Kubernetes, AWS IAM, database credentials, and other backends from a single control plane.
Skip if:
If your platform requires a managed, zero-ops secrets service, OpenBao requires self-hosting expertise. A managed service like Akeyless may reduce operational burden at the cost of a SaaS dependency.
Security teams centralizing encryption and key management
The encryption-as-a-service API lets applications encrypt data without owning or managing keys. Security teams define rotation policies, audit every key access via built-in audit logging, and revoke keys centrally without touching application deployments.
Skip if:
If your compliance requirements mandate a FIPS-validated HSM and you have no engineering bandwidth for integration, evaluate whether OpenBao's PKCS11 working group output meets your requirements before committing.
Kubernetes operators managing dynamic database credentials
OpenBao integrates with Kubernetes service accounts and can issue short-lived database credentials directly to pods via sidecar or init-container patterns. Credentials are scoped per workload and automatically revoked at TTL expiry, removing permanent database users from the equation.
Skip if:
If your Kubernetes cluster relies on Vault Secrets Operator as a Vault-native integration, verify OpenBao's compatibility with that operator before adopting it in production.
The problem it solves#
Managing secrets across modern infrastructure is one of the hardest operational problems in DevOps. An application stack might span multiple databases, cloud providers, Kubernetes clusters, and third-party APIs, each with credentials that need to be rotated, audited, and revoked without downtime. Handling this manually means secrets get stored in environment files, version-controlled config, or team wikis, creating security gaps that are hard to detect until something goes wrong.
When HashiCorp changed Vault's license from MPL-2.0 to the Business Source License in 2023, teams running Vault at scale lost the right to use future versions under an OSI-approved license. Many organizations faced a choice: pay for Vault Enterprise, migrate to a proprietary service like CyberArk or Akeyless, or freeze on the last open source release. None of those options preserved both open governance and Vault API compatibility.
How it solves it#
Secure Secret Storage
Stores arbitrary key/value secrets with encryption before writing to persistent storage, so access to the raw storage backend does not expose the secrets. Supports multiple storage backends including disk and PostgreSQL.
Dynamic Secrets for Cloud and Databases
Generates on-demand credentials for systems like AWS S3, SQL databases, and Kubernetes. Each set of dynamic credentials carries a TTL lease and is automatically revoked when the lease expires, reducing the window for credential misuse.
Encryption as a Service
Encrypts and decrypts data without storing it, providing centralized key management across clouds and datacenters. Applications call the API to encrypt data before persisting it, offloading key management from application code.
Lease-Based Secret Lifecycle
Every secret in OpenBao has a lease. At lease expiration, the secret is automatically revoked. Clients can renew leases via built-in API endpoints, and administrators can revoke individual secrets or entire trees, such as all secrets issued to a specific user.
Unified Identity and ACL System
Brokers access to secrets using a unified ACL system that merges identities across multiple cloud providers, Kubernetes service accounts, and authentication methods. Eliminates identity sprawl when infrastructure spans multiple providers.
Strengths and trade-offs#
Strengths
- MPL-2.0 License Under Linux Foundation GovernanceShips under the MPL-2.0 license, an OSI-approved open source license, with governance by the Linux Foundation. Unlike Vault Enterprise or CyberArk, there are no commercial tiers, per-node fees, or license compliance gates. Active backers include SAP (EU-funded), GitLab, Proton, ControlPlane, and Fermilab.
- Vault API CompatibilityForked from HashiCorp Vault's MPL-2.0 codebase, OpenBao preserves the Vault API surface. Teams migrating from Vault can repoint existing clients and tooling without rewriting integration code, lowering the migration cost compared to switching to a different secrets manager architecture.
- Active Development With Diverse Sponsorship8,009 GitHub stars, 590 forks, and a last push in September 2026. Multiple working groups are active on namespaces, PKCS11, scalability, supply chain, and UI. Sponsored development from SAP (EU NextGenerationEU funding), GitLab, and others means the project is not dependent on a single backer.
- Broad Contributor and Backer BaseBacked by a mix of commercial companies (SAP, GitLab, ControlPlane, Liquid Reply), research institutions (Fermilab), and infrastructure providers (Blendbyte for packages). This mix reduces the risk of a single company influencing the project's direction or its funding being withdrawn.
Trade-offs
- -Production deployment requires infrastructure expertiseRunning OpenBao in production requires configuring storage backends, TLS, audit logging, and HA setup. The development server mode is a single command, but a production deployment with proper unsealing, replication, and access policies takes meaningful ops effort. Not a zero-configuration install.
- -Active issue backlog from an ongoing forkWith 327 open issues, OpenBao carries a backlog typical of a project actively inheriting from a large codebase while managing its own roadmap. Not all issues are bugs, but teams should check the tracker for any items in their specific use area before adopting.
- -Fork launched in late 2023; ecosystem is still maturingOpenBao was created in November 2023. Some integrations, plugins, and enterprise patterns that Vault Enterprise has built over nearly a decade are still in progress or undocumented in OpenBao. Teams with niche Vault integration requirements should verify support before migrating.
openbao vs alternatives#
OpenBao vs HashiCorp Vault
OpenBao and HashiCorp Vault share the same origin codebase up to the MPL-2.0 fork point, but diverge on licensing, governance, and enterprise feature availability.
| Feature | OpenBao | HashiCorp Vault |
|---|---|---|
| License | MPL-2.0 (OSI-approved) | BSL 1.1 (post-1.13.x) |
| Self-hosting | Yes | Yes |
| Enterprise features | Community-developed | Paid enterprise tier |
| Governance | Linux Foundation | HashiCorp / IBM |
| API compatibility | Fork-point compatible | Full |
OpenBao is the better choice when you need an OSI-approved license, open governance, and Vault API compatibility without paying for Vault Enterprise. HashiCorp Vault Enterprise is still the better fit when you need specific enterprise features like Vault Secrets Operator, HSM integration, or commercial support SLAs, and are already paying for the HashiCorp stack.
OpenBao vs CyberArk
CyberArk is an enterprise privileged access management platform focused on human and machine identity security, while OpenBao is a developer-facing secrets manager built around API-accessible credential storage and dynamic secrets.
| Feature | OpenBao | CyberArk |
|---|---|---|
| License | MPL-2.0 (open source) | Proprietary |
| Self-hosting | Yes | Yes (appliance-based) |
| Primary focus | Developer secrets, dynamic creds | Privileged access management |
| API-first design | Yes | Partial |
OpenBao fits developer and platform teams building cloud-native infrastructure; CyberArk fits enterprise security teams managing privileged human accounts and session recording. CyberArk's market is compliance-heavy enterprises with dedicated security operations teams.
OpenBao vs Akeyless
Akeyless is a managed SaaS secrets manager with no self-hosting requirement, while OpenBao is fully self-hosted. Both support dynamic secrets and API-based access.
| Feature | OpenBao | Akeyless |
|---|---|---|
| License | MPL-2.0 (open source) | Proprietary SaaS |
| Self-hosting | Yes (required) | No (managed) |
| Operational overhead | Medium (infra required) | Low |
| Dynamic secrets | Yes | Yes |
OpenBao is the better choice when your team has the infrastructure expertise to self-host and wants full data control with an open source license. Akeyless fits teams that want secrets management without managing a server, accepting a SaaS dependency in exchange for reduced ops burden.
Quick start#
Deploy by cloning the repository and building the binary with the Go toolchain.
```bash
git clone https://github.com/openbao/openbao
cd openbao && go build -o bin/bao .
```What it's built on#
- Languages
- GoJavaScriptTypeScript
- Frameworks
- React
- Tooling
- RollupWebpack
FAQ#
Why was OpenBao forked from HashiCorp Vault?
HashiCorp changed Vault's license from MPL-2.0 to the Business Source License (BSL) in August 2023, restricting commercial use without a paid license. OpenBao was created to continue Vault development under an OSI-approved open source license, governed by the Linux Foundation rather than a single commercial entity. The project's mission statement explicitly commits to maintaining an OSI-approved license under open governance.
Is OpenBao compatible with HashiCorp Vault's API?
Yes. OpenBao was forked from Vault's MPL-2.0 codebase and maintains API compatibility with the fork-point release. Existing Vault clients, SDKs, and Terraform providers work with OpenBao. Newer Vault Enterprise features introduced after the fork are not present, but the core API surface is compatible and OpenBao continues to evolve it under community governance.
What license does OpenBao use?
MPL-2.0 (Mozilla Public License 2.0), an OSI-approved open source license. You can run it on your own infrastructure, use it commercially, and modify the source code. The main obligation is that modifications to MPL-licensed files must be shared under MPL-2.0 if distributed, but you can combine it with proprietary code in the same project without that obligation extending to the proprietary parts.
How do I install OpenBao?
Build from source with the Go toolchain by running 'go build -o bin/bao .' from the cloned repository root. Pre-built RPM and DEB packages are available at pkgs.openbao.org. A dev-mode server for local testing starts with './bin/bao server -dev', but production deployments require configuring a storage backend, TLS, and an unsealing strategy.
Who maintains OpenBao?
OpenBao is a Linux Foundation project with a Technical Steering Committee running under open governance principles. Active contributors include developers from SAP (funded by the EU NextGenerationEU program), GitLab, ControlPlane, Fermilab, Adfinis, and Liquid Reply, among others. The project also has active working groups on namespaces, PKCS11, scalability, supply chain, and UI.
Similar open-source tools#
Nexion
Web3 SSH manager that replaces passwords with crypto keys
security-audit-skill
Multi-phase security audits with machine-readable findings
tailcat
Encrypted tunnels between machines, no account or IP needed
hysteria
Fast and censorship-resistant proxy solution
Omnara
Open-source agent deployment API. Self-host or use Omnara Cloud.
next.js
Full-stack React framework with server-side rendering and MIT license.