OpenBao Features - Declarative Configuration

This is the third part of a multi-part series on OpenBao's features.

In the past few parts, we talked about low-level technical features that OpenBao core maintainers and plugin authors can take advantage of to make secrets management safer and more scalable.

This part focuses on something that applies to operators of OpenBao: better operator experience for initial configuration. We focus on one question:

Question

How can we make initial OpenBao deployment easier and more reproducible?

The answer lies in declarative self-initialization anddeclarative audit device creation.

These features available since OpenBao v2.4.0 allow operators to define the state of OpenBao prior to deploying it.

Audit Devices openbao.org/blog/features-declarative-configuration

Sensitive programs like Vault and OpenBao should always have audit logs. Ideally it would be hard to not them set up without audit logs, or at least, make it very hard to do so.

However, the API model of Vault made this difficult originally:

Operators would call sys/init to create seal information and return a root token.

Operators would then have to call sys/audit to create an audit device.

In the meantime, they'd want to be configuring OpenBao: creating auth mounts, policies, secret engines, and the like. Perhaps this was fully automated, like in OpenTofu, and it would be hard toguarantee a strict ordering, due to inherent parallelism.

Motivating us to solve this was one of the few remote code execution vulnerabilities (RCEs) in Vault: audit device configuration frequently interacted with the broader environment, including potentially in ways that lead to RCEs. While HashiCorp opted just topatch one small hole, we opted to reimagine how audit device configuration could be controlled by configuration owners.

Thus declarative audit devices were born.

Here, system operators--those with privileged access to the underlying configuration and broader execution environment--can define audit devices through configuration files, reloading them on SIGHUP. Th…