OpenBao vs HashiCorp Vault
OpenBao against HashiCorp Vault: MPL-2.0 community fork against Vault's Business Source License under IBM, feature gaps and additions (namespaces in OpenBao), storage and HA options, and who should switch.
OpenBao
Comparisons anchored on OpenBao, the MPL-2.0 Linux Foundation fork of HashiCorp Vault.
OpenBao vs HashiCorp Vault migration
What moving from Vault to OpenBao involves: the in-place binary swap the OpenBao guide describes, the Vault versions it was tested on, Enterprise-only features to replace, configuration changes and rollback planning.
OpenBao vs Vault Enterprise features
Which Vault Enterprise features OpenBao covers and which it does not: namespaces and read scaling on standbys against replication, HSM seals, Sentinel, control groups and FIPS builds.
OpenBao Raft integrated storage vs PostgreSQL storage
Which storage backend an OpenBao cluster should use: the built-in Raft integrated storage that replicates data across OpenBao nodes, or an external PostgreSQL server or cluster. Covers production status and HA support for each, the OpenBao project's recommendation for new operators, replication and network requirements, and tuning that each one needs.
OpenBao vs Infisical
A Vault-compatible secrets engine (MPL-2.0) against a developer-oriented secrets, certificate and PAM platform (MIT core with paid ee features): secret engines, Kubernetes delivery, dynamic secrets, PKI, and which features need a license.
OpenBao vs HashiCorp Vault vs Infisical
The secrets management shortlist compared on license (MPL-2.0, BSL 1.1, MIT with ee), migration paths from Vault, enterprise feature gating, and what self-hosting each involves.
OpenBao Shamir unseal vs auto-unseal
How an OpenBao cluster gets unsealed after restarts: Shamir key shares held by people versus auto-unseal through a cloud KMS or HSM. Covers recovery keys, automation, the unrecoverable-cluster risk if the seal is lost and which fits air-gapped sites.
OpenBao vs Kubernetes Secrets
Whether native Kubernetes Secrets are enough or an external secrets manager is needed: etcd storage defaults, encryption at rest, RBAC exposure, dynamic secrets and leases in OpenBao, and how teams combine the two through the Kubernetes auth method.
