# OpenBao (/docs/runtime/components/openbao)



Component Category [#component-category]

Access and security / secrets management

Component Description [#component-description]

OpenBao is an identity-based secrets and encryption management system for storing and controlling sensitive information.

Why It Is Used [#why-it-is-used]

In BullSequana AI Runtime, OpenBao helps centralize secret storage, access policies, and key management for platform services. This improves security, auditability, and operational consistency.

Learn More [#learn-more]

* [OpenBao documentation](https://openbao.org/docs/)
* [openbao/openbao on GitHub](https://github.com/openbao/openbao)

Deployment notes [#deployment-notes]

OpenBao deploys into the `openbao` namespace at sync wave 11 in the common tier. It runs in HA mode with Raft storage on a 10Gi persistent volume. A sidecar container handles auto-initialization (5 key shares, threshold 3) and auto-unseal on startup. Init keys are reflected to the external-secrets namespace using Reflector.

Interacts With [#interacts-with]

* `Keycloak`, through OIDC authentication configured directly in the platform manifests.
* `Gateway API` and `cert-manager`, because OpenBao is exposed through ingress with TLS-secured endpoints.
* `External Secrets Operator`, which syncs secrets from OpenBao into Kubernetes `Secret` resources.
* Kubernetes services and workloads, which consume injected secrets and rely on OpenBao-managed credentials.