ControlPlane Enterprise for OpenBao Selects PostgreSQL As Recommended Storage Engine

Although development of HashiCorp Vault has stagnated in critical areas that operators need to productively manage deployments, ControlPlane and OpenBao have proactively addressed several of Vault's most requested features (opens in a new tab). Many are already implemented, including recursive listing (opens in a new tab) and filtering of list responses (opens in a new tab).

And additional features are on the way, including search for KVv2 (opens in a new tab), a highly requested feature that is currently in early design and development, and a fresh implementation of Vault Enterprise's Managed Keys (opens in a new tab) as OpenBao's External Keys (opens in a new tab) in OpenBao v2.7.0.

The primary challenge for operators isn't represented in API-level changes, but the operational complexity of HashiCorp's guidance for Integrated Storage and Raft.

For over a decade, HashiCorp Vault has suffered reliability problems because HashiCorp's bespoke Raft implementation lacked transactions (opens in a new tab), a cornerstone of database design for decades, despite providing critical infrastructure. Consequently, consistency and reliability in Vault have often felt like a 'best effort' endeavour. And Integrated Storage or Consul have caused outages: BBolt brings many unique failure modes (opens in a new tab), Raft may require manual peers.json adjustment to restore consensus (opens in a new tab), and Performance Replication sidesteps Raft with a secondary WAL mechanism (opens in a new tab).

All of this requires companies to employ highly specialised Vault operators.

ControlPlane Enterprise for OpenBao has been built on that history; our experience managing Vault deployments for clients and troubleshooting downtime caused by Raft issues led us to invest in an alternative, PostgreSQL.

The Case for PostgreSQL over Raft

As the top database in StackOverflow's 2025 survey (opens in a new tab), PostgreSQL offers proven reliability that Vault lacks. ControlPlane has been engineering PostgreSQL into a first-class data storage engine, delivering (opens in a new tab) horizontal read scalability (opens in a new tab) to achieve full parity with the existing Raft support (opens in a new tab), better client consistency control semantics (opens in a new tab), and building an internal test suite to validate the behaviour of various secret engines.

We've also been busy validating the behaviour in various real-world scenarios. PostgreSQL-native Performance and Disaster Replication is far superior to manually managing Vault Enterprise replication: operators can rely on their preferred PostgreSQL physical replication semantics, whether CloudNativePG (opens in a new tab), EDB's Postgres AI (opens in a new tab), Patroni (opens in a new tab), or PostgreSQL's native replication primitives (opens in a new tab).

Many of the changes to support PostgreSQL are already in OpenBao v2.6 (opens in a new tab), with full capabilities rolling out in OpenBao v2.7 (opens in a new tab) later this month, September 2026.

Collaborating with Experts

To spearhead this effort, we have been collaborating closely with (opens in a new tab) CloudNativePG experts, including Gabriele Bartolini, VP and Chief Architect of Kubernetes at EDB. Alongside this effort, our security engineering team has developed a new reference architecture for OpenBao built on Kubernetes and PostgreSQL, to be released alongside OpenBao v2.7.

Want to find out more?

If you are ready to learn more about how easy it is to operate ControlPlane Enterprise for OpenBao, backed by PostgreSQL, contact our team today to discuss how we can support you and your organisation.

Additional links

Introduce GRPC-based invalidation mechanism - #3448 (opens in a new tab)

Support index headers for consistency in server, api - #3839 (opens in a new tab)