Stop leaking .env files. Encrypt each value with OpenBao Transit, give CI encrypt-only access and the app decrypt-only access, rotate keys without redeploying, and know when vals is the simpler answer.

An access key in ~/.aws/credentials is valid until somebody remembers to delete it. OpenBao can replace it with STS credentials you request when you need them and that expire on their own within the hour. Here's how we set it up, and how to keep the root key out of everyone's hands.

A static database password is a secret with no expiry date, known to everyone who has ever seen it. Dynamic credentials replace it with a user created on request and dropped when the lease ends. Here's how we run that on OpenBao, and the desktop client we wrote so the secure path is also the quick one.

Most teams leaving Vault Enterprise only use features that OpenBao and free Vault already have. The hard part of the move is the configuration, not the secrets, so we built an open source tool to migrate it. This post covers how the tool works and what it can't move.

In an era where proprietary licensing can threaten operational stability, OpenBao emerges as a vendor-neutral alternative for secrets management.

Stop managing certificates manually. Learn how to automate Kubernetes SSL/TLS for Ingress and internal services using cert-manager, Vault, and OpenBao.

Discover how OpenBao, the open-source alternative to HashiCorp Vault, delivers secure, community-driven secrets management.

This post explains why different Apache Cassandra versions handle authentication differently, and provides a step‑by‑step recovery guide for resetting lost superuser passwords.

Vals-Operator 0.6.2 syncs secrets from external stores into Kubernetes secrets. This release updates core libraries and adds secret templates.