OpenBao or HashiCorp Vault: secrets management after the licence change
Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.
Do credentials sit in configuration files in your estate? WZ-IT introduces central secrets management with OpenBao or Vault and provides ongoing managed operations. Discuss your setup
HashiCorp Vault has been the default answer to central management of credentials and certificates for years. Since the 2023 licence change, OpenBao sits alongside it, a fork under the Linux Foundation.
The question that follows is often conducted as a matter of belief and is a factual one: does the licence change affect my use at all? For most operators the answer is no. Where it is yes, the move is surprisingly straightforward.
All figures from the repositories and licence files, as of 2 September 2026.
Table of contents
- The two at a glance
- What happened in 2023
- Does the BSL affect your use
- What OpenBao is technically
- What a move costs
- What you give up with OpenBao
- Which one for which situation
- What is actually hard in operation
- How we approach this at WZ-IT
- Further guides
The two at a glance
Figures from the public repositories, as of 2 September 2026.
| HashiCorp Vault | OpenBao | |
|---|---|---|
| Expertise | Vault | OpenBao |
| Repository | hashicorp/vault | openbao/openbao |
| GitHub stars | 36,161 | 7,137 |
| Licence | BUSL-1.1 | MPL-2.0 |
| Stewardship | IBM (since the HashiCorp acquisition) | Linux Foundation |
| Origin | 2015 | 2023, forked from Vault 1.14.0 |
The star count mainly reflects the age difference. Vault has existed since 2015, OpenBao since 2023. For a decision, stewardship is more informative: a listed company on one side, a foundation on the other.
What happened in 2023
In August 2023 HashiCorp moved Vault and other products from the Mozilla Public License 2.0 to the Business Source License 1.1. The BSL permits use and modification but prohibits providing the software as a competing offering. After four years per release it converts to MPL-2.0.
The Open Source Initiative does not recognise BSL as an open-source licence, because it restricts the field of use.
OpenBao emerged in response, forked from version 1.14.0, the last release published under MPL-2.0, and placed with the Linux Foundation.
IBM's acquisition of HashiCorp completed in early 2025. That has reached the licence text: the licensor named there is now International Business Machines Corporation. The sequence of these licence changes and what became of each we wrote up separately.
Does the BSL affect your use
That is the question that comes before all others, and in most cases the answer is no.
| Your use | Affected? |
|---|---|
| Managing your own credentials internally | no |
| Vault in your own infrastructure for your own applications | no |
| Operating Vault as a service for customers | check, the core case of the restriction |
| Embedding Vault in a product and shipping it | check |
Anyone using Vault to manage the credentials of their own systems faces no restriction from the licence change. The BSL targets providers building a competing offering.
For IT service providers the third case is the relevant one: anyone operating Vault as part of an offering for customers should have the terms reviewed by a lawyer. We do not provide legal advice on this.
What OpenBao is technically
Not a rewrite but a continuation. OpenBao shares Vault's API, commands, secrets engines and auth methods.
In practice: existing clients, scripts and Terraform resources generally continue to work unchanged. Anyone who knows Vault knows OpenBao.
The project now develops independently, including namespaces and horizontal read scalability. It does not merely follow Vault but sets its own priorities. That is the most important difference from forks that go quiet after a year.
What a move costs
Less than a migration usually suggests, because the interface stays the same.
What stays the same: applications retrieving credentials, scripts, Terraform resources, the command line.
What takes work: the state has to be transferred, the storage backend set up, unsealing re-established and auth methods reconnected. On a cluster with several nodes that is a maintenance window, not an afternoon.
What needs checking: whether features from Vault's Enterprise tier are in use. That is exactly where a move fails when it fails.
What you give up with OpenBao
Named plainly, because it otherwise surfaces later:
- HashiCorp's Enterprise tier with cross-datacenter replication and HSM integration
- The hosted offering from HashiCorp
- Vendor support with contractual response times
Anyone using or needing one of those has no equivalent replacement in OpenBao. For environments running only the free edition of Vault anyway, the point does not arise.
Which one for which situation
| Starting point | Obvious choice | Reason |
|---|---|---|
| New introduction, internal use | OpenBao | MPL-2.0, foundation stewardship, compatible |
| Existing Vault, internal use, working | keep Vault | the licence does not affect you, no cause to switch |
| Vault as a service for third parties | have it reviewed, then usually OpenBao | the core case of the BSL restriction |
| Enterprise features in use | Vault | no equivalent replacement in OpenBao |
| Vendor support contractually required | Vault | OpenBao has no corresponding vendor |
What is actually hard in operation
The licence question is the one that gets discussed. These four decide the outcome:
Unsealing. After every restart the system has to be unsealed. Anyone storing the key shares neither securely nor accessibly faces a sealed system after an outage and cannot get in. That is the failure worth fearing, not the outage itself.
Backup. The state lives in the storage backend, and backing it up with a tested restore is a precondition, not an extra. Secrets management without a tested restore is a central point of failure.
Rotation. The real benefit comes not from storing but from short-lived credentials renewed automatically. Anyone only depositing permanent keys has built an elaborate password store.
The access path. Applications need a way to authenticate without requiring another permanent secret for that. Building that chain cleanly is the most demanding part of the introduction.
How we approach this at WZ-IT
For new introductions we use OpenBao, because MPL-2.0 and foundation stewardship settle the question of future licence changes and compatibility leaves no disadvantage.
For existing Vault installations we advise doing nothing in most cases. Anyone working internally is unaffected by the BSL, and switching without cause creates risk in a place where risk is particularly expensive.
What we settle before every introduction is unsealing: where the key shares live, who holds them and how recovery runs. We rehearse that once together before the system goes into production.
Further guides
- Open-source licence changes: the chronicle - the wider context
- Vaultwarden - password management for people, not machines
- Managed operations - operations, backup and tested restores
- Compliance in operations - evidence requirements around access
Unclear whether the licence question affects you? We review the use, say whether action is needed and carry out the move where it makes sense. Book a call
Sources
Set up or replace secrets management
We set up Vault or OpenBao, connect it to your systems and take on operations.
Frequently Asked Questions
Answers to important questions about this topic
A fork of HashiCorp Vault created after the 2023 licence change. It was forked from the last release published under MPL-2.0, version 1.14.0. The project sits under the Linux Foundation and is licensed under MPL-2.0.
The Business Source License 1.1. The licence text now names International Business Machines Corporation as licensor, following IBM's acquisition of HashiCorp. After four years per release the licence converts to MPL-2.0.
For internal use, generally not. The restriction targets providing Vault as a competing offering. Anyone using Vault to manage their own credentials is unaffected. Anyone operating it as a service for third parties should have the terms reviewed.
Less than expected. OpenBao shares Vault's API, commands, secrets engines and auth methods. Existing clients, scripts and Terraform resources generally continue to work unchanged. The move is more a configuration matter than a rewrite.
HashiCorp's commercial Enterprise tier with advanced replication and HSM integration, the hosted offering, and vendor support. Anyone using those features has no equivalent replacement in OpenBao.
No. The project develops independently, including namespaces and horizontal read scalability. It does not merely track Vault but sets its own priorities.
Considerably smaller by visibility: around 7,100 GitHub stars against around 36,200 for Vault, as of September 2026. That mainly reflects the age difference, not suitability. For a decision, stewardship under the Linux Foundation carries more weight.
As soon as credentials are needed by more than one application and sit in configuration files or environment variables, yes. The benefit lies less in storing than in rotation, traceable access and short-lived credentials instead of permanent keys.
Unsealing after a restart and backing up the state. Being unable to reopen a sealed system after an outage is the failure genuinely worth fearing. Both belong rehearsed, not just documented.
Yes, such as Infisical for a simpler entry point or the secrets management of your cloud provider. For mixed environments with your own infrastructure, Vault and OpenBao remain the most complete solutions.
Written by
Timo Wevelsiep
Co-Founder & CEO
Co-Founder of WZ-IT. Specialized in cloud infrastructure, open-source platforms and managed services for SMEs and enterprise clients worldwide.
LinkedInLet's Talk About Your Idea
Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.
Arrange a callback
Companies worldwide trust WZ-IT
