OpenBao
Linux Foundation fork of Vault, born the same way OpenTofu was: a licence move to the BSL
Quick Overview
| Company | Linux Foundation (OpenBao project, OpenSSF) |
|---|---|
| Category | DevOps & Infrastructure as Code |
| Headquarters | Distributed |
| Founded | 2023 |
| EU Presence | Vendor-neutral; no single jurisdiction |
| Data Location | Runs wherever you run it |
| Open Source | Yes |
| Compliance | Open source (MPL 2.0); governed by the Linux Foundation OpenSSF |
| Pricing | Free and open source |
| Free Option | Free |
| Replaces | HashiCorp Vault (BSL), Vault Enterprise |
Detailed Review
HashiCorp moved Vault to the Business Source Licence in the same announcement that moved Terraform, and the response was the same: a fork, governed by a foundation rather than a company.
OpenBao is that fork for secrets, maintained under the Linux Foundation's OpenSSF since late 2023, MPL 2.0 licensed. The logic is identical to OpenTofu's: a Vault estate holds every database credential and API key an organisation runs on, and no single participant in a foundation-governed project can relicense it the way HashiCorp did to its own product twice over.
Functionally it is Vault's feature set, inherited from the same codebase: encrypted key/value storage, dynamic secrets generated on demand for databases and Kubernetes rather than long-lived credentials sitting around waiting to leak, and policy-based access control down to the path level.
It runs wherever you run it, with no telemetry and no vendor anywhere in the path, which matches the self-hosted posture of every other open-source tool in this category rather than the billed-per-seat model of a hosted secrets manager sitting in front of your infrastructure.
The honest limits follow directly from being younger: OpenBao's plugin catalogue and third-party integrations lag Vault's after a decade of ecosystem growth on the original project, there is no managed SaaS offering so someone on the team operates and patches it, and there is no single commercial vendor to sign a support contract with — only the community and a handful of specialist consultancies.
Migrating an existing Vault estate onto it needs real testing against your own policies, not a find-and-replace on the binary name.
What OpenBao does well
- Same fork-under-a-foundation story as OpenTofu, now for secrets
- Linux Foundation OpenSSF governance, no single company owns it
- MPL 2.0, fully free and open source
- Dynamic secrets for databases, Kubernetes and more
- Runs wherever you run it, no vendor in the path
Where OpenBao falls short
- Younger project than Vault, smaller plugin ecosystem
- No managed SaaS offering — you operate it yourself
- No commercial vendor for paid support contracts
- Migrating from Vault needs real testing, not just a rename
Standout feature. OpenBao is Vault's OpenTofu: the same BSL-driven fork, the same Linux Foundation governance, now applied to secrets instead of infrastructure.
Pros and Cons
Pros
- Same fork-under-a-foundation story as OpenTofu, now for secrets
- Linux Foundation OpenSSF governance, no single company owns it
- MPL 2.0, fully free and open source
- Dynamic secrets for databases, Kubernetes and more
- Runs wherever you run it, no vendor in the path
Cons
- Younger project than Vault, smaller plugin ecosystem
- No managed SaaS offering — you operate it yourself
- No commercial vendor for paid support contracts
- Migrating from Vault needs real testing, not just a rename
Alternatives to OpenBao
Frequently Asked Questions
What is OpenBao?
HashiCorp moved Vault to the Business Source Licence in the same announcement that moved Terraform, and the response was the same: a fork, governed by a foundation rather than a company.
OpenBao is that fork for secrets, maintained under the Linux Foundation's OpenSSF since late 2023, MPL 2.0 licensed. The logic is identical to OpenTofu's: a Vault estate holds every database credential and API key an organisation runs on, and no single participant in a foundation-governed project can relicense it the way HashiCorp did to its own product twice over.
Where is OpenBao based?
OpenBao operates from Distributed, which places it under Vendor-neutral; no single jurisdiction. Compliance: Open source (MPL 2.0); governed by the Linux Foundation OpenSSF.
What does OpenBao cost?
Free and open source. Free.
Who is OpenBao best for?
Teams needing a secrets manager without licence risk. OpenBao is Vault's OpenTofu: the same BSL-driven fork, the same Linux Foundation governance, now applied to secrets instead of infrastructure.
What are the drawbacks of OpenBao?
Younger project than Vault, smaller plugin ecosystem. No managed SaaS offering — you operate it yourself. No commercial vendor for paid support contracts. Migrating from Vault needs real testing, not just a rename.
Is OpenBao a good alternative to HashiCorp Vault (BSL)?
OpenBao is built as a European alternative to HashiCorp Vault (BSL): Linux Foundation fork of Vault, born the same way OpenTofu was: a licence move to the BSL. It will not be a like-for-like feature match in every respect, so check the review above for where the two genuinely differ before switching.
How does OpenBao compare to other DevOps & Infrastructure as Code tools?
OpenBao is one of several European DevOps & Infrastructure as Code tools we cover. It is most often compared with HashiCorp Vault (BSL), Vault Enterprise.