OpenBao

Component Category

Access and security / secrets management

Component Description

OpenBao is an identity-based secrets and encryption management system for storing and controlling sensitive information.

Why It Is Used

In BullSequana AI Runtime, OpenBao helps centralize secret storage, access policies, and key management for platform services. This improves security, auditability, and operational consistency.

Learn More

• OpenBao documentation
• openbao/openbao on GitHub

Deployment notes

OpenBao deploys into the openbao namespace at sync wave 11 in the common tier. It runs in HA mode with Raft storage on a 10Gi persistent volume. A sidecar container handles auto-initialization (5 key shares, threshold 3) and auto-unseal on startup. Init keys are reflected to the external-secrets namespace using Reflector.

Interacts With

• Keycloak, through OIDC authentication configured directly in the platform manifests.
• Gateway API and cert-manager, because OpenBao is exposed through ingress with TLS-secured endpoints.
• External Secrets Operator, which syncs secrets from OpenBao into Kubernetes Secret resources.
• Kubernetes services and workloads, which consume injected secrets and rely on OpenBao-managed credentials.