OpenBao Secrets Management¶

Overview¶

OpenBao is an open-source secrets management platform, forked from HashiCorp Vault after it moved to a non-open-source license. OpenBao provides a secure, centralized way to manage sensitive data such as:

API keys and tokens
Database credentials
TLS certificates
Encryption keys
Any sensitive configuration

Key Features¶

Centralized Secrets Storage: Single source of truth for all secrets
Dynamic Secrets: Generate credentials on-demand with automatic expiration
Encryption as a Service: Encrypt/decrypt data without exposing keys
Access Control: Fine-grained policies based on identity
Audit Logging: Complete audit trail of all secret access
Kubernetes Integration: Native support for injecting secrets into pods

Architecture¶

┌─────────────────────────────────────────────────────────────────┐
│                         OpenBao Server                          │
│                   https://openbao.prod.skatzi.com               │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────────┐ │
│  │   OIDC Auth │  │ AppRole Auth│  │    KV v2 Secrets        │ │
│  │  (Keycloak) │  │    (ESO)    │  │    Engine               │ │
│  └─────────────┘  └─────────────┘  └─────────────────────────┘ │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘
         │                    │
         │                    │
    ┌────▼────┐          ┌────▼────┐
    │  Users  │          │   ESO   │
    │  (CLI)  │          │Operator │
    └─────────┘          └────┬────┘
                              │
                         ┌────▼────┐
                         │   K8s   │
                         │ Secrets │
                         └─────────┘

Authentication Methods¶

Method	Use Case	How it Works
OIDC	Human users via CLI	Authenticates through Keycloak, browser-based login
AppRole	External Secrets Operator	Service-to-service auth, syncs to K8s Secrets

Secrets Structure¶

Secrets are organized hierarchically under the clusters/ path:

clusters/
└── hetzner-mgmt/           # Management Cluster
    ├── info                # Cluster metadata
    ├── test                # Test secret
    ├── apps/               # Application secrets
    │   ├── frontend/
    │   └── backend/
    ├── databases/          # Database credentials
    └── external-services/  # Third-party API keys

Current Projects & Access¶

Cluster: hetzner-mgmt¶

Path	Description	Access
`clusters/hetzner-mgmt/*`	Management cluster secrets	`mgmt-k8s-admins` group

Policies¶

Policy	Description	Capabilities
`admin`	Full administrative access	All operations on all paths
`mgmt-cluster-admin`	Hetzner mgmt cluster admin	Full CRUD on `clusters/hetzner-mgmt/*`
`external-secrets`	External Secrets Operator	Read-only on `clusters/hetzner-mgmt/*`

Keycloak Group Mappings¶

Keycloak Group	OpenBao Policy	Access Level
`mgmt-k8s-admins`	`mgmt-cluster-admin`	Full access to mgmt cluster secrets
`administrators`	`admin`	Full administrative access

AppRole for External Secrets Operator¶

Role	Policy	Purpose
`external-secrets`	`external-secrets`	ESO reads secrets and syncs to K8s

Kubernetes Secret Sync (External Secrets Operator)¶

Secrets from OpenBao are synced to Kubernetes using External Secrets Operator (ESO).

How it works¶

Secrets are stored in OpenBao at clusters/hetzner-mgmt/<component>/<secret-name>
An ExternalSecret resource is created in the component's namespace
ESO reads from OpenBao and creates a native Kubernetes Secret
Applications use the Kubernetes Secret normally (via existingSecret, env vars, etc.)

Example ExternalSecret¶

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: gitea-admin
  namespace: gitea
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: openbao
    kind: ClusterSecretStore
  target:
    name: gitea-admin-secret
    creationPolicy: Owner
  data:
    - secretKey: username
      remoteRef:
        key: hetzner-mgmt/gitea/admin
        property: username
    - secretKey: password
      remoteRef:
        key: hetzner-mgmt/gitea/admin
        property: password

Quick Links¶

Setup Guide - Install CLI and authenticate
CRUD Operations - Create, read, update, delete secrets
Create New Project - Set up secrets for a new project

URLs¶

Service	URL
OpenBao API	`https://openbao.prod.skatzi.com`
Keycloak (Auth)	`https://keycloak.prod.skatzi.com/realms/skatzi`

Security Notes¶

Unseal Keys

OpenBao requires unsealing after every restart. The unseal keys and root token are stored securely in Terraform tfvars and should never be committed to version control.

External Secrets Operator

ESO syncs secrets from OpenBao to Kubernetes Secrets. The AppRole credentials are stored in Terraform and deployed via the openbao-approle secret in the external-secrets namespace.

Least Privilege

Always request the minimum permissions needed. Use project-specific policies rather than broad admin access.