OpenBao

Deploy OpenBao, an open source secrets management tool for storing, managing, and distributing sensitive data such as secrets, certificates, and keys. OpenBao is a community-driven fork of HashiCorp Vault.

Note: While OpenBao is a fork of a production-ready 1.14.x release of HashiCorp Vault, the OpenBao codebase is still early in development and is subject to change as development takes place. Follow the release cycles for any breaking changes to minimize any downtime in a production environment.

1. Deploy OpenBao

 Estimated deployment time: 5–7 minutes

Base distribution and plan

• Supported distribution: Ubuntu 24.04 LTS
• Recommended plans: All plan types and sizes can be used. For best results, use an 8GB Dedicated CPU or Shared CPU Compute Instance.

Configuration options

StackScript ID: 1403816

Notes:

• After the app deployment completes, the password for your limited sudo user is generated and stored in the .credentials file in the home directory, along with application-specific passwords. Log in to your instance as root through the Lish console or SSH, then run cat /home/$USERNAME/.credentials to view its contents.
• You can automatically configure a custom domain (optional) during deployment. To do that:
  1. First, configure your domain to use Linode’s name servers via your registrar. See Configure your domain's authoritative name servers for details.
  2. Once you complete that, specify the Linode API token, subdomain, and domain for the app in Cloud Manager or via API/CLI/Terraform.

Use API, CLI, or Terraform

curl --location 'https://api.linode.com/v4/linode/instances' \
    --header 'Content-Type: application/json' \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer abc123def456hij789klm' \
    --data-raw '{
        "region": "us-east",
        "type": "g6-standard-2",
        "image": "linode/ubuntu24.04",
        "label": "my-openbao-cluster-one-click-app",
        "root_pass": "@C0mpl3x#P@ssw0rd",
        "stackscript_id": 1403816,
        "stackscript_data": {
            "country_name":"US",
            "state_or_province_name":"Massachusetts",
            "locality_name":"Cambridge",
            "organization_name":"Akamai Technologies",
            "email_address":"jsmith@example.com",
            "user_name":"jsmith"
        }
    }'

linode-cli linodes create \
    --region us-east \
    --type g6-standard-2 \
    --label my-openbao-one-click-app \
    --image linode/ubuntu24.04 \
    --root_pass @C0mpl3x#P@ssw0rd \
    --stackscript_id 1403816 \
    --stackscript_data '{"country_name":"US", "state_or_province_name":"Massachusetts", "locality_name":"Cambridge", "organization_name":"Akamai Technologies", "email_address":"jsmith@example.com", "user_name":"jsmith"}'

resource "linode_instance" "my-linode" {
  region         = "us-east"
  type           = "g6-standard-4"
  label          = "my-openbao-one-click-app"
  image          = "linode/ubuntu24.04"
  root_pass      = "@C0mpl3x#P@ssw0rd"
  stackscript_id = 1403816
  stackscript_data = {
    "country_name"           = "US"
    "state_or_province_name" = "Massachusetts"
    "locality_name"          = "Cambridge"
    "organization_name"      = "Akamai Technologies"
    "email_address"          = "jsmith@example.com"
    "user_name"              = "jsmith"
  }
}

2. Access OpenBao

1. Log in to the instance via the Lish console or SSH and view the generated credentials file at the sudo user's home directory /home/$SUDO_USER/.credentials.

2. You can run bao commands to continue setting up your OpenBao instance. Confirm the OpenBao status.

   Bash

   bao status

3. If you receive an error when running the bao status command, reload the environment variable by sourcing your server’s bashrc file.

   Bash

   source /root/.bashrc

   The OpenBao instance is initialized as part of the deployment.

Unseal OpenBao

After the deployment is complete, OpenBao is sealed.

Perform these unseal steps any time the openbao service is brought down and then brought up again. For example, when performing systemctl restart openbao or restarting the host machine.

You can find the unseal keys along with the root token in the .credentials file in the sudo user's home directory /home/$SUDO_USER/.credentials. Store unseal keys and the root token in separate secure locations.

1. With VAULT_ADDR set appropriately, execute the unseal command.

   Bash

   bao operator unseal

2. You get prompted to provide one unseal key. Then press Enter.

   The output indicates that one out of the two required unseal keys has been provided.

   PromptOutput

   Unseal Key (will be hidden):

   Key                Value
   ---                -----
   Seal Type          shamir
   Initialized        true
   Sealed             true
   Total Shares       3
   Threshold          2
   Unseal Progress    1/2
   Unseal Nonce        n/a
   Version            2.0.0-alpha20240329
   Storage Type       raft
   HA Enabled         false

3. Perform the unseal command again.

   Bash

   bao operator unseal

4. Enter a different unseal key when the prompt appears.

   The resulting output should indicate that OpenBao is now unsealed (Sealed:false).

   PromptOutput

   Unseal Key (will be hidden):

   Key                     Value
   ---                     -----
   Seal Type               shamir
   Initialized             true
   Sealed                  false
   Total Shares            3
   Threshold               2
   Version                 2.0.0-alpha20240329
   Build Date              2024-03-29T21:37:50Z
   Storage Type            raft
   Cluster Name            vault-cluster-9b0549a6
   Cluster ID              4cb3e7c0-6ce5-2d54-2549-f88d29cb9691
   HA Enabled              true
   HA Cluster              n/a
   HA Mode                 standby
   Active Node Address     <none>
   Raft Committed Index    27
   Raft Applied Index      27

   OpenBao is now operational.

Additional resources

For more information about the installed packages, see their official documentation.

• OpenBao Documentation