Stop leaking .env files. Encrypt each value with OpenBao Transit, give CI encrypt-only access and the app decrypt-only access, rotate keys without redeploying, and know when vals is the simpler answer.

Most teams leaving Vault Enterprise only use features that OpenBao and free Vault already have. The hard part of the move is the configuration, not the secrets, so we built an open source tool to migrate it. This post covers how the tool works and what it can't move.

When PID 1 in a container isn't your workload, Kubernetes can only report what the wrapper tells it. A practical look at where that goes wrong, and how to make process death visible again.