Sealed OpenBao (1/2): why no auto-unseal
All my Ansible playbooks read their secrets (database passwords, API keys, tokens) from OpenBao, the open-source fork of HashiCorp Vault. So secrets are written neither in the Git repo nor in encrypted files passed around: Ansible asks for them at deploy time, with an AppRole identity that only has read access. Sealed, unsealed: what it…