GitLab
Native Secrets Manager integration (since 18.8). ADR 007 formally chose OpenBao.
Open source secrets management, with enterprise accountability
Remove long-lived credentials, give workloads a verifiable identity, and make secret access reliable and auditable. Enterprise for OpenBao adds hardened builds, LTS builds and support from the engineers who help build the project on top of the open source release you use today.
Talk to us37%
of all OpenBao commits from our team
5000+
GitHub stars and growing
100+
active contributors, 76 in the last quarter
10x
potential savings vs Vault Enterprise
Take control of secrets sprawl
Long-lived credentials scattered across Git, container images, CI variables and shared configuration are among the most exploited weaknesses in modern systems. Most organisations run a mix of cloud-native secret stores, Kubernetes Secrets and ad hoc patterns, without a shared view of where secrets live or which workloads have the highest risk.
OpenBao removes these standing credentials, gives workloads verifiable identity, and makes access reliable and auditable across clouds and on-prem. If you are using OpenBao in production, you have to answer some new questions. How do you get upstream maintenance beyond the latest release cycle, and how do you get CVE response that is more than best effort? When an auditor asks who supports your secrets platform, can you name a real company or do you point at a community mailing list?
- Long-lived credentials spread across Git, images, CI and config
- No shared view of where secrets live or which workloads are riskiest
- Community OpenBao maintains only the latest release cycle, CVE response is best effort
- Hard to evidence who stands behind the platform at audit
What's included
What good looks like
No more standing credentials
Applications stop carrying long-lived secrets, and you can prove who accessed what.
Priced by what you run
A subscription scoped by the plugin types you use, not metered by your automation.
One platform across clouds and on-prem
Dynamic secrets, Transit encryption and a full PKI platform as first-class engines.
A partner you can call
A named Technical Account Architect who knows your environment, and support on the open source platform.
The Vault landscape has changed
The Fork in the Road
Your Vault contract is up for renewal. Which path reduces risk?
The Status Quo
IBM and Hashicorp Vault
Acquired for $6.4B in Feb 2025. Vault is now IBM Software.
Compounding Cost Increases
Custom-quoted licences priced on client count, with renewal uplifts that licensing advisers report at 25 to 60 percent since the acquisition. The bill grows with every identity you add.
Opaque Security Posture
CVE patches follow IBM's disclosure timeline. No dedicated threat modelling, proactive testing, or incident response services.
Vendor Dependency
One vendor controls the roadmap, the pricing and the end-of-life dates. HCP Vault Secrets was sold until June 2025 and reaches end of life in July 2026.
Innovation Stagnation
Features your platform needs, such as namespaces, stay behind the Enterprise paywall, and the roadmap now answers to IBM's portfolio rather than the community.
BSL 1.1 Licence
Source-available, not open source, since August 2023. You can read the code, but you cannot build a product on it, fork it or have a second vendor support it.
The Open Source Path
ControlPlane Enterprise for OpenBao
Built by the #1 contributor. Supported by world-leading engineers.
Up to 10x Cost Savings
A subscription scoped by the plugin types you use, not by client count, so adding workloads and identities does not add to the bill.
End-to-End Enterprise Security
Hardened, signed builds with SBOMs, LTS releases with vulnerability patching, a signed VEX statement per CVE and an optional FIPS 140-3 compliant edition.
Direct Access to the #1 Contributor
The engineer behind 37 percent of all OpenBao activity leads our team, and your escalation path ends with the people who write the code.
Faster Innovation, Free
Namespaces, per-namespace seals and horizontal read scalability were Vault Enterprise-only and ship free in OpenBao, with every gap closed upstream under an accepted RFC.
MPL 2.0 Licence
Open source under the Linux Foundation, so no single vendor can change the licence, and support covers pure upstream builds too.
What makes it enterprise-ready
Why OpenBao?
1
Drop-in Vault replacement
The same API compatibility, and a drop-in replacement for most use cases. OpenBao is MPL 2.0 licensed and is truly open source, and has been a Linux Foundation project since 2023 and under OpenSSF governance since June 2025.
2
Enterprise validation
Proven by leading organisations including GitLab, SAP, NVidia, Epic Games, Proton, G-Research and more
3
CRA compliance proof
EU Cyber Resilience Act reporting began in September 2026. Get managed and governed open source from software supply chain experts.
We created an operationalised vault for tier 1 banks
Why ControlPlane?
Open source leadership
We proudly boast multiple CNCF TAG Security co-chairs and OpenSSF core contributors. We are part of the FINOS AI leadership, our founder is the CISO for OpenUK and we employ leading open source maintainers for our enterprise distributions.
Our proven enterprise playbook
We built Flux Enterprise for Morgan Stanley and others, and we're building the same model for OpenBao.
Global coverage
Global support with teams in North America, EMEA, and APAC. We have the widest coverage for OpenBao.
Created
Alex Scheel, Founding Engineer
The former TSC Chair and #1 OpenBao contributor with 37% of all project activity, 5,000+ contributions. Ex-HashiCorp Vault CryptoSec team, Alex built PKI, transit, KMIP, ACME, CA rotation, OCSP, and cross-cluster unification in Vault.
Integrated
GitLab Native Integration
GitLab chose OpenBao as its native Secrets Manager (18.8+ Ultimate). ControlPlane's expertise spans the full lifecycle from code to pipeline and production operations at scale.
Deployed
Tier 1 Global Banks
Financial services depth at the highest security tier including case studies at Citigroup, JPMC, and Morgan Stanley. Regulated industry deployment is our core expertise.
Same hands. Same expertise. From Vault to OpenBao.
OpenBao's Lineage
The Origin
2015-2023
Our team built Vault's CryptoSec layer, PKI, and Transit at HashiCorp.
In Production
2023-2025
Operationalised at scale for 30M+ users. Selected as GitLab's native Secrets Manager.
The Future
2026+
Founding OpenSSF members and leading OpenBao maintainer combine to lead ControlPlane's open source Vault alternative.
Feature-by-feature comparison
OpenBao vs Vault Enterprise
Feature OpenBao Vault Enterprise (IBM) Notes Core secrets engine Yes Yes Full parity; additional secret and auth engines available on demand. Kubernetes integrations Yes Yes Compatibility with ESO, CSI-Provider & Agent. Namespaces GA (v2.3.1) Yes Was Vault Enterprise-only; now free. Namespaces Sealing GA (v2.6.0) No Per-namespace seal mechanisms, allowing strong tenant cryptographic separation. Horizontal Read Scalability (Raft) GA (v2.5.0) Yes Was Vault Enterprise-only; free and enabled by default. Core secrets engine
- OpenBao
- Yes
- Vault Enterprise (IBM)
- Yes
- Notes:
- Full parity; additional secret and auth engines available on demand.
Kubernetes integrations
- OpenBao
- Yes
- Vault Enterprise (IBM)
- Yes
- Notes:
- Compatibility with ESO, CSI-Provider & Agent.
Namespaces
- OpenBao
- GA (v2.3.1)
- Vault Enterprise (IBM)
- Yes
- Notes:
- Was Vault Enterprise-only; now free.
Namespaces Sealing
- OpenBao
- GA (v2.6.0)
- Vault Enterprise (IBM)
- No
- Notes:
- Per-namespace seal mechanisms, allowing strong tenant cryptographic separation.
Horizontal Read Scalability (Raft)
- OpenBao
- GA (v2.5.0)
- Vault Enterprise (IBM)
- Yes
- Notes:
- Was Vault Enterprise-only; free and enabled by default.
Feature OpenBao Vault Enterprise (IBM) Notes Declarative plugins with OCI distribution GA (v2.5.0) No Plugins declared in configuration and pulled as OCI images, pinned by digest since v2.7.0. External KMS plugins GA (v2.6.0) No KMS plugins registered declaratively and used as auto-unseal mechanisms. PKCS#11 auto-unseal GA (v2.2.0) Enterprise only HSM or KMS unseal in the open core, not gated to a paid tier. CEL policy and roles Yes No Common Expression Language for JWT and PKI roles; Vault's equivalent is Sentinel, Enterprise only. Inline authentication Yes No Authenticate and call in one request, with single-flow MFA. Declarative plugins with OCI distribution
- OpenBao
- GA (v2.5.0)
- Vault Enterprise (IBM)
- No
- Notes:
- Plugins declared in configuration and pulled as OCI images, pinned by digest since v2.7.0.
External KMS plugins
- OpenBao
- GA (v2.6.0)
- Vault Enterprise (IBM)
- No
- Notes:
- KMS plugins registered declaratively and used as auto-unseal mechanisms.
PKCS#11 auto-unseal
- OpenBao
- GA (v2.2.0)
- Vault Enterprise (IBM)
- Enterprise only
- Notes:
- HSM or KMS unseal in the open core, not gated to a paid tier.
CEL policy and roles
- OpenBao
- Yes
- Vault Enterprise (IBM)
- No
- Notes:
- Common Expression Language for JWT and PKI roles; Vault's equivalent is Sentinel, Enterprise only.
Inline authentication
- OpenBao
- Yes
- Vault Enterprise (IBM)
- No
- Notes:
- Authenticate and call in one request, with single-flow MFA.
Feature OpenBao Vault Enterprise (IBM) Notes Disaster-recovery replication No Yes The gap that matters most; the PostgreSQL storage backend is the funded track towards it. Performance replication No Yes High availability within a cluster is supported; cross-cluster replication is not yet. Sentinel policy engine No Yes CEL is the equivalent mechanism in OpenBao, not a drop-in. HSM and FIPS options Yes Yes ControlPlane's optional FIPS 140-3 compliant edition, Level 1 via CMVP Certificate #5247. LTS releases with vulnerability patching Yes, with ControlPlane Yes Upstream OpenBao supports the latest release only; the subscription adds LTS. Disaster-recovery replication
- OpenBao
- No
- Vault Enterprise (IBM)
- Yes
- Notes:
- The gap that matters most; the PostgreSQL storage backend is the funded track towards it.
Performance replication
- OpenBao
- No
- Vault Enterprise (IBM)
- Yes
- Notes:
- High availability within a cluster is supported; cross-cluster replication is not yet.
Sentinel policy engine
- OpenBao
- No
- Vault Enterprise (IBM)
- Yes
- Notes:
- CEL is the equivalent mechanism in OpenBao, not a drop-in.
HSM and FIPS options
- OpenBao
- Yes
- Vault Enterprise (IBM)
- Yes
- Notes:
- ControlPlane's optional FIPS 140-3 compliant edition, Level 1 via CMVP Certificate #5247.
LTS releases with vulnerability patching
- OpenBao
- Yes, with ControlPlane
- Vault Enterprise (IBM)
- Yes
- Notes:
- Upstream OpenBao supports the latest release only; the subscription adds LTS.
Feature OpenBao Vault Enterprise (IBM) Notes Licence MPL 2.0 BSL 1.1 Open source versus source-available since August 2023. Governance Linux Foundation, OpenSSF IBM Open governance; no single vendor can change the licence. Pricing model Plugin types in use Client identities The subscription does not grow with workloads or identities. Support ControlPlane, 24/7 global IBM Named Technical Account Architect; covers upstream builds too. Roadmap Public RFCs Vendor-set Every gap closed in the open under an accepted RFC. Licence
- OpenBao
- MPL 2.0
- Vault Enterprise (IBM)
- BSL 1.1
- Notes:
- Open source versus source-available since August 2023.
Governance
- OpenBao
- Linux Foundation, OpenSSF
- Vault Enterprise (IBM)
- IBM
- Notes:
- Open governance; no single vendor can change the licence.
Pricing model
- OpenBao
- Plugin types in use
- Vault Enterprise (IBM)
- Client identities
- Notes:
- The subscription does not grow with workloads or identities.
Support
- OpenBao
- ControlPlane, 24/7 global
- Vault Enterprise (IBM)
- IBM
- Notes:
- Named Technical Account Architect; covers upstream builds too.
Roadmap
- OpenBao
- Public RFCs
- Vault Enterprise (IBM)
- Vendor-set
- Notes:
- Every gap closed in the open under an accepted RFC.
Everything you need
Comprehensive Secrets Management
Automatically secure and unseal master keys using Hardware Security Modules or Cloud KMS.
Raft-based horizontal read scalability, free and enabled by default, with the PostgreSQL storage backend in development for further scale and disaster recovery.
An optional FIPS 140-3 compliant edition, Level 1 via CMVP Certificate #5247, with FIPS mode enforced at build and run time and recorded in the SLSA build artefacts.
A full software bill of materials with every build, LTS releases with vulnerability patching, and a signed VEX statement with every CVE assessment.
Hardened, signed OpenBao images served from ControlPlane's enterprise registry, with provenance you can verify before anything runs.
Namespaces and per-namespace seals, free in OpenBao, give each tenant strong cryptographic separation on one platform.
Technical Architecture Services
Outcome driven engineering support packages to assess, implement and harden your OpenBao platform
Talk to usNamed enterprise adopters
Trusted by Industry Leaders
NVIDIA
Builds NVIDIA Cloud Functions with OpenBao
Broadcom
Bundles OpenBao with VMWare Cloud Foundation
Funded Development Roadmap
Every known gap vs Vault Enterprise has a funded development track
2026
2026-2027
Emergency & Parallel Unseal
Initial RFC landed; pending development.
2027
How onboarding works
Every subscription includes a milestone-driven onboarding journey with a named Technical Account Architect. Each phase is a working session, not a lecture, and ends with an explicit sign-off.
Understand your secrets risk, environment and success metrics, and agree what success looks like.
Design the target platform with us. We will map your namespaces, auth methods, secrets engines, unseal and high-availability topology, and how workloads will get identity instead of credentials.
Stand up the hardened distribution, migrate the first secrets and auth methods, and validate with a pilot workload.
Tune your policies, rotation and audit logging, and retire the long-lived credentials that the pilot has replaced.
Bring the remaining applications and teams onto the platform, with your Technical Account Architect alongside.
Built in the open, under the Linux Foundation
OpenBao is a Linux Foundation project with open governance and an MPL-2.0 licence. ControlPlane leads upstream contribution and publishes its work in the open.
OpenBao is the open source fork of Vault, so the operational model, the concepts and most of the estate carry across. If you are weighing a renewal, switching support is a smaller decision than switching platforms.
Supporting Sustainable Open Source
Slide 1 of 2
Frequently Asked Questions
Yes. OpenBao is a Linux Foundation project under open governance, forked from Vault's last open source release, with an active release cadence and adopters including Nvidia, GitLab, which chose it as the native Secrets Manager integration, and VMware Cloud Foundation, which bundles it into their solution. Enterprise for OpenBao adds the LTS releases, patching and 24/7 support an audited estate needs on top of the open source project.
Yes. OpenBao is the open source fork of Vault, so the operational model, the concepts, policies and client integrations such as External Secrets Operator, the CSI provider and Agent carry across. We start with a readiness assessment of your deployment: secrets engines, auth methods and custom plugins. We flag anything that OpenBao does not yet ship, and we produce the migration plan for your deployment. If your estate depends on disaster-recovery or performance replication, we will discuss how to handle this as part of the design rather than after a migration.
ControlPlane Enterprise for OpenBao: FIPS Edition complies with NIST’s FIPS 140-3 Level 1 through integration with CMVP Certificate #5247. LTS versions are supportable under this module. The software ships with a wrapper which ensures that `GODEBUG=fips140=on` is enforced and ControlPlane’s SLSA build artifacts document that `GOFIPS140=inprocess` or GOFIPS140=compliant is used at build time, in compliance with Go’s documentation and the module’s Security Policy. Formal FIPS 140-3 validation is on our funded development roadmap. Alex Scheel, who built Vault's original cryptographic layer at HashiCorp, is leading this work.
OpenBao does not yet ship Vault Enterprise's disaster-recovery or performance replication. High availability within a cluster is supported through integrated Raft storage, and the PostgreSQL storage backend now in development, with its RFC accepted and initial code landed, is the funded track towards horizontal scalability and disaster recovery. Until it lands we design around the gap with tested backup and restore and documented recovery procedures, and if cross-cluster replication is essential to you today we will advise if Vault may still be the right call.
OpenBao is licensed under MPL-2.0 and governed by the Linux Foundation, so no single vendor can change its licence. Vault moved to the Business Source Licence in August 2023 and remains source-available rather than open source under IBM. Enterprise for OpenBao adds hardened builds, LTS and support on top of the open source project, and support covers pure upstream builds too, so you are never locked to our distribution.
ControlPlane employs OpenBao's #1 contributor (37% of all project activity) as our founding engineer. We have a track record of operationalising open source in the world's most complex environments and building enterprise offerings around commercial open source, including with Flux CD. Unlike some providers, we provide global support. This includes North America, EMEA and APAC, so you can get help whatever your business hours may be.
They can be the right answer for a small team. The differences that matter at scale are structural: where their service runs, their tenancy or infrastructure you control (which decides data residency and audit), and how it is priced (per seat or per identity counting machines). Our subscription is scoped by the plugin types you use and does not count your automation or usage like Vault. With our distribution, dynamic secrets, PKI and transit encryption are not gated to a top paid tier. OpenBao gives you all of that as open source you run anywhere.
Speak to an expert
Engage with world-leading AI and cloud security specialists