OpenBao Features - Declarative Plugins
This is the fourth part of a multi-part series on OpenBao's features.
Last time we talked about how to declaratively configure audit devices and initialize OpenBao. We saw how this made integration of OpenBao in a wider ecosystem or product (such as EdgeX) easier.
Like the last part, this part focuses on the operator experience, but for consumption of OpenBao's plugins: auth methods, secrets engines, auto-unseal devices, and more.
Our motivation here is to build towards a more OpenTofu-like, extensible ecosystem. Easier consumption, community-maintained plugins, and a future plugin registry will lead to more developers writing plugins and expand the usefulness of OpenBao for everyone.
Question
What integrations would you like OpenBao to have? How would you like to see writing plugins made easier?
Contact us to share your thoughts or contribute to the ecosystem!
Overview
Nearly everything within OpenBao is pluggable. OpenBao supports several types of plugins currently:
| Type | Description |
|---|---|
| Auth | Allow bringing sources of identity--JWTs, certificates, passwords--and exchanging them for OpenBao tokens. |
| Secret | Allow generating credentials (whether passwords for databases, PKI certificates, static secrets, and more) and protected through OpenBao's tokens and authorization policies. |
| Database | Implement database-specific logic for updating and managing access for use with the database dynamic secret engine. |
| KMS | Implement specialized interfaces for using HSM and KMS devices (such as YubiHSM or GCP CloudKMS) for auto-unseal (and external keys in the upcoming v2.7.0). |
Plugins have two primary classifications:
| Classification | Description |
|---|---|
| Builtin | Distributed as part of the main bao binary artifact. No external process is started. |
| External | Distributed as stand-alone binaries, requiring installation and configuration to use. Spawns an external process (managed by the OpenBao server) to handle plugin requests. |
For example, secrets-pki is a builtin secret plugin, but secrets-aws is an external secret plu…
点赞
收藏
点踩
分享