Vault / OpenBao
Passwords and keys out of the code: issued on demand, traced, revocable.
Vault, and its open-source fork OpenBao, exist to get secrets — database passwords, API keys, certificates, payment tokens — out of the places they should never be: a Git repository, a shared configuration file, a message in a team chat. Instead, each application asks for its secret when it needs it, gets it if it's entitled to, and the request leaves a trace. The day someone leaves the company or a key leaks, the question 'where has it been copied?' finally has an answer.
My take on secret management: it's the job everyone postpones, and the one that costs the most when the incident arrives.
In most SMBs I audit, production credentials sit in an environment file copied from machine to machine, sometimes in the repository history — readable, in other words, by everyone who ever had access to the project, including those who no longer do. Vault fixes that, but I don't install it everywhere: it's one more service to operate, and for a one-server project with three secrets, encrypted files in the repository do the job without adding anything to maintain.
What I look at is the number of hands and the number of environments, not the size of the application.
- →Several environments and several people: secrets circulate, and they must be revocable
- →Traceability requirement: knowing which application read which secret, and when
- →Rotation to hold on database credentials or API keys
- →Automated deployment pipeline that needs secrets without a human copying them
- ×One server, three secrets, one person: encrypted files in the repository are enough and need no operating
- ×No automation in place: Vault earns its keep when machines consume secrets, not when humans read them
- ×Team with no operational capacity: an unavailable vault blocks every deployment, so it becomes critical itself
- →SOPS + ageEncrypted secrets in the repository: the right level as long as there's no rotation or revocation to hold
- →CI provider secretsEnough when only the deployment pipeline consumes the secretsView page
- →Cloud provider vaultsNative integration if the whole infrastructure lives with a single provider
- →Ansible VaultEncrypting variables inside the playbooks, with no extra service to operateView page
- 01
Inventory first: the list of existing secrets and their copies, repository history included
- 02
Immediate rotation of anything leaked into a repository: moving a compromised secret doesn't protect it
- 03
One path and one access policy per application, never a single token that opens everything
- 04
Dynamic secrets where the database allows it: a short-lived credential rather than a permanent password
- 05
Documented unseal and recovery procedure: it's what's always missing on the day of the outage
+ Related services
Offerings associated with this techVault or OpenBao?
OpenBao is the open-source fork born from HashiCorp's 2023 licence change, now hosted by the Linux Foundation. Behaviour is the same and compatibility is near complete. For a new project with no tie to the commercial offering, OpenBao is a defensible choice; for an existing Vault deployment, migration is in no way urgent. It's exactly the Terraform and OpenTofu situation.Isn't an encrypted file in the repository enough?
Often yes, and that's what I recommend for small scopes: file-encryption tools in the repository give a good share of the benefit at zero cost. What they don't give is immediate revocation, automatic rotation, short-lived credentials and a read log. Moving up is justified when those four become necessary.What does it cost to run?
The software is open source. The running cost is that of a service you must keep available: it becomes a checkpoint in every deployment, so it gets monitored and backed up like a database. The vendor's managed offering, or a cloud provider's, trades that operating work for a subscription.What does setting it up cost?
The weight isn't installing the vault, it's the number of applications to connect, the number of secrets to inventory and rotate, and the state of what exists — a repository history riddled with credentials calls for a full rotation before anything else. The amount is set in the quote, after a free initial scoping session that puts the scope in writing before any commitment.What happens if the vault goes down?
Applications already running keep going with the secrets they hold; what stops is startups and deployments. That's why a vault is deployed with high availability or, failing that, with a proven recovery procedure and tested backups — the same requirement as the production database.
A project involving Vault / OpenBao?
Describe your context: I'll suggest the right level of investment.
First callLet's talk aboutyour project.
Describe your need in a few lines. Reply within 24h to plan next steps, detailed quote within 48h.
- 24h response
- NDA on request