OpenBao - Leadership from the Ground Up

Securing the widespread adoption of AI, supporting the imminent post-quantum cryptographic migrations, and increasingly sophisticated supply chain attacks are keeping industry leaders up at night. Secrets management, cryptographic inventory, and identity platforms are critical areas of investment in 2026: these are the foundational components platform teams utilize to meet the accelerating business demands.

Teams can’t just adopt unproven, unfamiliar tooling.

But at the same time, existing solutions must be ready to scale to handle the increasing load and new demands.

Secure, Community-First Secrets Management

At ControlPlane, our team has been preparing OpenBao, the open source secrets manager governed under the Linux Foundation’s OpenSSF, from the ground up to support these new demands. OpenBao is a fork of the familiar, tested HashiCorp Vault, but with improvements to its foundations and an ambitious roadmap. This tool gives platform teams the ability to manage secrets, provide secure cryptographic APIs, and serves as a broker between various forms of identity.

Early in the project’s history, I had the foresight to push for removing many poorly maintained storage backends, many of which are still carried by HashiCorp Vault. This led to a series of core feature improvements highlighted in my recent series on the OpenBao blog: paginated lists and transactional storage. Since these improvements were landed in 2024 as a part of OpenBao v2.1.0, they’ve become fundamental to the way OpenBao works.

In implementing namespaces, a Vault Enterprise feature for multi-tenant separation, we realized that companies will need to scale their instance to keep pace with rising developer productivity and application counts. The use of transactions and paginated lists allowed namespaces to scale reliably to whatever volume your business requires.

With multi-issuer support for safer SSH CA rotation, our goal was to eliminate the inherent downtime in the existing SSH CA mount when issuing keys are rotated. By leveraging transactions, updates and migrations are now strictly atomic, significantly reducing risk during this swap.

Notably these core improvements have led to vastly increased scale as demonstrated on the OpenBao limits page. This means we can scale to handle the management complexity as teams onboard onto a common secrets management platform while adopting agentic AI. So that when the onslaught of static and dynamic secrets requests caused by agentic consumption occurs, we’ll be ready to handle the traffic efficiently.

With the reintroduction of PostgreSQL as a supported storage backend, I also proposed a design for better operationalisation and ensured that paginated lists and transactions were a zero-day feature for a backend with better write throughput. This type of consistent execution with an eye towards scale is demonstrated in every design ControlPlane endorses.

Our driving the use of Common Expression Language (CEL) (a policy language used by CNCF projects like Kubernetes) for authorising authentications in JWT and signed certificates in PKI let us seamlessly adopt SPIFFE JWTs for agentic identity and so much more. This shifts control over complex authorisation decisions for agentic identities from upstream developers back into the hands of teams.

Future Proofing Secrets Management for the Agentic Era

Looking forward, OpenBao’s designs for strong migrations will ensure less downtime for organisations on upgrades, ensuring 24/7 consumption in the agentic age will not be impacted by necessary security patches for the secrets management platform.

Through ControlPlane’s cryptographic centre of excellence, OpenBao is primed to lead the adoption of post-quantum cryptographic algorithms, ensuring that new agentic risks do not impact organisational data security.

If you are ready to assess your secrets management estate, evaluate options for better scaling to handle the load of AI agents, or to understand more about Enterprise for OpenBao, contact our team today to discuss how we can support you and your organisation.