OpenBao v2.7.0 is a secrets server, not a password manager
OpenBao v2.7.0 stores arbitrary secrets, issues temporary credentials, manages certificates, and performs encryption through an API. Applications can request a database or cloud credential, receive a lease, renew it when appropriate, and let the server revoke it later. That is a different job from keeping a shared team password list. OpenBao sits in the request path for machine credentials, so availability, policy mistakes, and recovery procedures affect the systems that depend on it.
The strongest reason to choose it is control. The server uses the MPL-2.0 license and the project describes community governance under the OpenSSF. Teams coming from Vault will recognize the model, while the current code publishes supported API and SDK modules at version 2. The README draws a firm boundary around those libraries: importing the entire OpenBao application as a Go dependency is unsupported.
Our build passed in 294 seconds, while the tests exceeded 900 seconds
Our sandbox installed 684 Go packages in 75 seconds and completed the build in 294 seconds. The checkout at commit a87e809 contained 5,385 files, about 646,504 lines of source, and occupied 75.9 MB before dependencies. That is a substantial security product rather than a small daemon. A cold build is long enough to matter in ephemeral development environments and CI jobs.
The test command timed out at 900 seconds with 41 passed and 6 failed out of 47. Its final lines list several helper packages with no test files and successful results for logical, time, user-agent, and version helpers. The tail does not expose one common failure or prove that the six failures share a cause. Our test method therefore supports a narrow conclusion: this commit built, but the complete command did not pass inside a 15-minute run.
Development takes 1 command; production needs an operating model
After compilation, the README starts a development server with 1 command. That path is useful for learning the API, yet it omits the decisions that make a secrets service trustworthy: persistent storage, initialization, unseal or recovery material, TLS, authentication, policy design, audit handling, backups, and a restore drill. OpenBao can reduce credential sprawl only if somebody owns those parts after the first successful request.
Version 2.7.0 widens the production surface. Its release adds external keys for PKI and Transit, post-quantum signature support, consistency controls, PostgreSQL read scaling, and a PebbleDB backend. Several former built-ins, including LDAP and Kerberos components and some KMS seals, moved to external plugins. Existing operators should read the change list as migration work, since a new feature and a packaging change can affect the same restart.
The v2.7.0 package can ship a configuration that will not start
Open issue 4077 reports a concrete v2.7.0 failure: the Debian package supplies a configuration using file storage after that server backend was removed. The reporter reproduced the resulting unknown storage type file startup error on 2 Proxmox hosts. A pull request was already discussing a replacement configuration on September 25, which is evidence of active response, but a fresh package user still needs to inspect the shipped HCL before enabling the service.
Storage migration deserves a separate rehearsal. Open issue 3921 reports that v2.6.0 and v2.6.2 can migrate the root namespace from file storage while leaving child namespace tables in the old format. In that report, the first boot succeeds and the second boot panics on both Raft and PostgreSQL. The report concerns a specific namespace migration, not every upgrade, but its timing makes a simple start-and-health-check acceptance test inadequate. Restart the restored copy before approving a migration.
Eighteen CI workflows show activity, not a guarantee for your cluster
The repository had 18 CI workflow files, a Dockerfile, 7,552 stars, and 321 open issues and pull requests when fetched on September 25, 2026. Its last push was September 24, one day after the v2.7.0 release. Issue 2581 is updated daily with flaky tests seen in CI, and recent pull requests address the new storage defaults. Those dates show an active project and an active defect queue at the same time.
The v2.7.0 notes contain 9 security entries, covering request-header enforcement, plugin execution boundaries, policy evaluation, namespace isolation, audit logging, and PKI behavior. That release cadence is encouraging for a security-sensitive service, but it also makes prompt patch review part of ownership. OpenBao is the better bet when open governance and license terms are decisive and your team can practice restores. If you mainly need a friendly place to sync application secrets, compare Infisical before accepting this operational load.