Do credentials sit in configuration files in your estate? WZ-IT introduces central secrets management with OpenBao and provides ongoing managed operations. Discuss your setup
HashiCorp Vault has been the default answer to central management of credentials and certificates for years. Since the 2023 licence change, OpenBao sits alongside it, a fork under the Linux Foundation.
The question that follows is often conducted as a matter of belief and is a factual one: does the licence change affect my use at all? For most operators the answer is no. Where it is yes, the move is surprisingly straightforward.
All figures from the repositories and licence files, as of 2 September 2026.
Table of contents
- The two at a glance
- What happened in 2023
- Does the BSL affect your use
- What OpenBao is technically
- What a move costs
- What you give up with OpenBao
- Which one for which situation
- What is actually hard in operation
- How we approach this at WZ-IT
- Further guides
The two at a glance
Figures from the public repositories, as of 2 September 2026.
| HashiCorp Vault | OpenBao | |
|---|---|---|
| Expertise | no managed offering (BSL licence) | OpenBao |
| Repository | hashicorp/vault | openbao/openbao |
| GitHub stars | 36,161 | 7,137 |
| Licence | BUSL-1.1 | MPL-2.0 |
| Stewardship | IBM (since the HashiCorp acquisition) | Linux Foundation |
| Origin | 2015 | 2023, forked from Vault 1.14.0 |
The star count mainly reflects the age difference. Vault has existed since 2015, OpenBao since 2023. For a decision, stewardship is more informative: a listed company on one side, a foundation on the other.
What happened in 2023
In August 2023 HashiCorp moved Vault and other products from the Mozilla Public License 2.0 to the Business Source License 1.1. The BSL permits use and modification but prohibits providing the software as a competing offering. After four years per release it converts to MPL-2.0.
The Open Source Initiative does not recognise BSL as an open-source licence, because it restricts the field of use.
OpenBao emerged in response, forked from version 1.14.0, the last release published under MPL-2.0, and placed with the Linux Foundation.
IBM's acquisition of HashiCorp completed in early 2025. That has reached the licence text: the licensor named there is now International Business Machines Corporation. The sequence of these licence changes and what became of each we wrote up separately.
Does the BSL affect your use
That is the question that comes before all others, and in most cases the answer is no.
| Your use | Affected? |
|---|---|
| Managing your own credentials internally | no |
| Vault in your own infrastructure for your own applications | no |
| Operating Vault as a service for customers | check, the core case of the restriction |
| Embedding Vault in a product and shipping it | check |
Anyone using Vault to manage the credentials of their own systems faces no restriction from the licence change. The BSL targets providers building a competing offering.
For IT service providers the third case is the relevant one: anyone operating Vault as part of an offering for customers should have the terms reviewed by a lawyer. We do not provide legal advice on this.
What OpenBao is technically
Not a rewrite but a continuation. OpenBao shares Vault's API, commands, secrets engines and auth methods.
In practice: existing clients, scripts and Terraform resources generally continue to work unchanged. Anyone who knows Vault knows OpenBao.
The project now develops independently, including namespaces and horizontal read scalability. It does not merely follow Vault but sets its own priorities. That is the most important difference from forks that go quiet after a year.
What a move costs
Less than a migration usually suggests, because the interface stays the same.
What stays the same: applications retrieving credentials, scripts, Terraform resources, the command line.
What takes work: the state has to be transferred, the storage backend set up, unsealing re-established and auth methods reconnected. On a cluster with several nodes that is a maintenance window, not an afternoon.
What needs checking: whether features from Vault's Enterprise tier are in use. That is exactly where a move fails when it fails.
What you give up with OpenBao
Named plainly, because it otherwise surfaces later:
- HashiCorp's Enterprise tier with cross-datacenter replication and further HSM features. Auto-unseal through an HSM via PKCS#11 is also offered by OpenBao since version 2.2 (changelog 2.2.0, March 5, 2025); from version 2.7 it is loaded as an external plugin from the openbao-plugins collection (OpenBao: PKCS#11 seal, as of October 2026)
- The hosted offering from HashiCorp
- Vendor support with contractual response times
Anyone using or needing one of those has no equivalent replacement in OpenBao. For environments running only the free edition of Vault anyway, the point does not arise.
Which one for which situation
| Starting point | Obvious choice | Reason |
|---|---|---|
| New introduction, internal use | OpenBao | MPL-2.0, foundation stewardship, compatible |
| Existing Vault, internal use, working | keep Vault | the licence does not affect you, no cause to switch |
| Vault as a service for third parties | have it reviewed, then usually OpenBao | the core case of the BSL restriction |
| Enterprise features in use | Vault | no equivalent replacement in OpenBao |
| Vendor support contractually required | Vault | OpenBao has no corresponding vendor |
What is actually hard in operation
The licence question is the one that gets discussed. These four decide the outcome:
Unsealing. After every restart the system has to be unsealed. Anyone storing the key shares neither securely nor accessibly faces a sealed system after an outage and cannot get in. That is the failure worth fearing, not the outage itself.
Backup. The state lives in the storage backend, and backing it up with a tested restore is a precondition, not an extra. Secrets management without a tested restore is a central point of failure.
Rotation. The real benefit comes not from storing but from short-lived credentials renewed automatically. Anyone only depositing permanent keys has built an elaborate password store.
The access path. Applications need a way to authenticate without requiring another permanent secret for that. Building that chain cleanly is the most demanding part of the introduction.
Still unsure which tool fits? The orientation workshop sorts out your requirements and delivers a prioritised topic list with a recommendation per topic. From €1,490 excl. VAT, remote.
How we approach this at WZ-IT
For new introductions we use OpenBao, because MPL-2.0 and foundation stewardship settle the question of future licence changes and compatibility leaves no disadvantage.
For existing Vault installations we advise doing nothing in most cases. Anyone working internally is unaffected by the BSL, and switching without cause creates risk in a place where risk is particularly expensive.
What we settle before every introduction is unsealing: where the key shares live, who holds them and how recovery runs. We rehearse that once together before the system goes into production.
Further guides
- Open-source licence changes: the chronicle - the wider context
- Vaultwarden - password management for people, not machines
- Managed operations - operations, backup and tested restores
- Compliance in operations - evidence requirements around access
Unclear whether the licence question affects you? We review the use, say whether action is needed and carry out the move where it makes sense. Book a call
