Course · Training · Workshop
Secrets Management with OpenBao
Two days hands-on with OpenBao for developers and DevOps engineers: authenticate, write policies, use KV, database, PKI and Transit secrets engines, inject secrets in Kubernetes and fetch dynamic secrets in GitLab CI/CD - without vendor lock-in.
Built with Adfinis, co-maintainer of OpenBao and provider of Secretz Enterprise (OpenBao enterprise subscription).
Passwords in environment variables, tokens in the CI/CD settings, certificates renewed by hand: in many teams secrets are still where they should not be. OpenBao is the open-source fork of HashiCorp Vault under the Linux Foundation - API-compatible with Vault and free of licence worries. In this course you learn to use OpenBao as a developer and DevOps engineer: you log in with the right auth method, write policies that grant exactly what an application needs, use static and dynamic secrets, issue certificates with PKI and encrypt data with Transit. Then you bring the secrets to where they are needed - into Kubernetes pods with the Agent Injector, the CSI provider or the External Secrets Operator, into GitLab pipelines with JWT authentication and directly into your application. The course is built with Adfinis, co-maintainer of OpenBao.
What participants say
These customers booked courses in the same topic cluster.More customers →
Content
The course consists of the following topics. We select and weight them together with you, depending on your applications, pipelines, platform and the group’s prior knowledge. We work throughout in a Kubernetes cluster with OpenBao, GitLab and sample applications in the letsboot labmachine.
OpenBao fundamentals
- What problem secrets management solves - and what it does not
- OpenBao and HashiCorp Vault: shared roots, API compatibility, differences
- Core concepts: paths, mounts, tokens, leases and TTLs
- Working with the CLI, the API and the web UI
- Hands-On: first steps with a running OpenBao
Authentication
- Auth methods for people, machines and workloads
- Userpass, OIDC, AppRole, Kubernetes and JWT compared
- Tokens, token types and the token lifecycle
- Entities, aliases and groups
- Hands-On: log in with different auth methods and inspect the tokens
Policies
- Policy syntax, paths, capabilities and templated policies
- Least privilege: grant an application exactly what it needs
- Testing and debugging policies
- Hands-On: write and test policies for an application and a team
Secrets engines
- KV v1 and v2: versioning, metadata, soft delete
- Database secrets engine: dynamic credentials with leases and revocation
- PKI: an internal CA, issuing and renewing short-lived certificates
- Transit: encryption as a service, key rotation and rewrapping
- Hands-On: dynamic database users and certificates for a sample application
Kubernetes integration
- Kubernetes auth method with service account tokens
- OpenBao Agent Injector: secrets as files in the pod
- Secrets Store CSI Driver with the OpenBao provider
- External Secrets Operator: syncing secrets into Kubernetes secrets
- Which pattern fits which use case
- Hands-On: deliver secrets to an application with all three patterns
GitLab CI/CD with JWT
- ID tokens in GitLab and the JWT auth method
- Roles and bound claims per project, branch and environment
- Dynamic secrets in the pipeline instead of stored CI/CD variables
- Hands-On: pipeline fetches a short-lived database credential for its deployment
Application integration
- Reading secrets via API and client libraries
- OpenBao Agent and Proxy: auto-auth, caching and templating
- Renewing leases and handling rotation without a restart
- Hands-On: application reads dynamic credentials and survives a rotation
- Hands-On: Secrets for AI Coding Agents
Secrets in daily work
- Finding and removing secrets in code, repositories and pipelines
- What to do when a secret leaks: revoke, rotate, review audit logs
- Moving applications from HashiCorp Vault to OpenBao
- Self-service for development teams: requesting access, onboarding new applications
Optional exam
- Practical exam in the lab - tasks, not multiple choice
- Certificate and Credly badge for everyone who passes
The goal is that every developer and DevOps engineer on the team uses OpenBao the way it is meant to be used: no secrets in code, pipelines or config files, short-lived credentials and policies that stay understandable. Do you want to introduce and run OpenBao yourself? Then see the course OpenBao Operations & Architecture for architecture, high availability, audit, backup, upgrades and migration from Vault.
The actual course content may differ from the above depending on the trainer, delivery, duration and the composition of participants.
Request this course in-house
Request a public date
No suitable public date? Register without obligation — once there is enough interest we schedule a new public date and let you know first.
More about OpenBao
OpenBao is a community-driven fork of HashiCorp Vault that emerged after Vault's license change. OpenBao remains fully open source under the Mozilla Public License 2.0 and provides a sustainable alternative for secrets management.Further Resources:
History and Development
OpenBao emerged in 2023 as a response to HashiCorp's decision to place Vault under the Business Source License (BSL). The Linux Foundation initiated the project to ensure a fully open-source alternative controlled by the community.
The project is governed by a governance board consisting of representatives from various companies and the community. OpenBao maintains API compatibility with Vault while pursuing an independent development direction. Development focuses on transparency, community participation, and sustainable open-source principles.