OpenBao Tutorial from A to Z

[sysadmin-info]

In fact all is done via a Bash script. So all you need to do is to follow 4 simple steps to install openBAO on any Linux machine.

See the URL https://sysadmin.info.pl/en/blog/integrating-openbao-password-manager-vault-for-enhanced-secret-management-in-gitlab

At the end there is a walkthrough video.

I am using Vault mostly for testing purpose when I have to login to applications.

I always provide tested and complex solutions that can be implemented quickly and easily.

[cipherboy]

\o hey @sysadmin-info! I think since you wrote this, we've gotten official release available now, with some installation instructions: https://openbao.org/docs/install/ that should be a little faster than compiling from source.

If you're interested, the bao command supports a -format=json option to output json so some of your grep responses could be replaced with a more stable jq if you'd prefer. :-) Nice to see a walkthrough video featuring GitLab though! The existing Vault integration should also support OpenBao, so you would be able to use GitLab generated JWTs for pipeline authentication instead of hard-coding the token in the variables.

Let us know if you're interested in co-publishing a blog post! See meeting info from this week's community call for more details.

[sysadmin-info]

For sure I will do this, but currently I am busy, so hard to say when I will find time to read the manual and proceed with the tutorial.

[jmls]

so I need to build a custom binary , but need to use the source from 1.14.x (where x is the last tag before the licence change)

if I were to pull openbao, which commit# should I use to be the equivalent of 1.14.x ? I can't seem to find a 1.14 tag in the repo

Once this is done, I'll migrate then to the 2.02 release over the next week or so

[cipherboy]

@jmls This is from the FAQ on our website:

OpenBao was forked prior to upstream's last commit (8993802) prior to the BUSL. This corresponds to a few commits after 1.14.8, but prior to 1.14.9 being cut. From here forward, we'll be adhering to our compatibility policy to provide API-compatibility with upstream when possible.

It isn't a tag since upstream didn't tag it.

[jmls]

perfect, thank you !