Sealed OpenBao (1/2): why no auto-unseal

All my Ansible playbooks read their secrets (database passwords, API keys, tokens) from OpenBao, the open-source fork of HashiCorp Vault. So secrets are written neither in the Git repo nor in encrypted files passed around: Ansible asks for them at deploy time, with an AppRole identity that only has read access.

Sealed, unsealed: what it means

OpenBao encrypts everything it stores with a master key. At startup it doesn’t know that key: it’s sealed. It runs and answers requests, but refuses to read or write any secret. To unseal it, the key has to be reconstructed. There are two broad approaches:

• Shamir: at initialisation, the key is split into n shares, t of which are enough to rebuild it. At startup, those shares are entered by hand (bao operator unseal);
• auto-unseal: the key is entrusted to an external service (a cloud KMS, an HSM, another Vault). OpenBao fetches it by itself at startup.

My choice: Shamir, no auto-unseal

bao operator init -key-shares=5 -key-threshold=5
# Unseal Key 1: …   (×5)
# Initial Root Token: …

Here all five shares are needed (t = n = 5), and none is stored on the server. They’re kept in a separate place, with copies on two other physical media. The choice has specific reasons:

• stealing the disk or a backup yields nothing: without the shares, OpenBao’s data is just an encrypted blob;
• no dependency on a cloud provider: KMS auto-unseal would make the whole fleet depend on a cloud account and its availability;
• a single server: auto-unseal mostly makes sense for clusters that restart often, which isn’t my case.

The price

After any reboot (kernel update, power cut, crash), OpenBao comes back sealed. And since every playbook reads its secrets from it, no deployment is possible on any machine until someone enters the shares. Ansible’s symptom is explicit:

fatal: … Vault is sealed

It’s a deliberate trade-off: a little human intervention after a reboot, in exchange for a vault that never opens by itself. You just mustn’t forget it, which is the subject of the next post.

---

This post is part of a series of sysadmin notes (tag “sysadmin notebook”).
Series “Sealed OpenBao”, part 1/2. · Next post → (coming 31 Oct) · Version française