openbao-secrets

OpenBao Secrets Access

How to get a credential without creating a standing one, and how to handle it once you have it. Two rules carry most of the weight: mint, don't store, and reading is pre-authorized, writing is gated.

Agent quickstart

The fast path for a read, in order:

1. Log in with flow-lock approle-token, which mints one fresh single-use secret_id for the target AppRole and logs in with it. Supply BAO_ADDR and the AppRole issuer pair from Doppler:

   token=$(doppler run -p iac-conf-mgmt -c prd -- flow-lock approle-token ROLE)
   

   Replace ROLE with the target AppRole name. Run flow-lock help for usage.

2. Read the value from the KV path you need:

   value=$(BAO_TOKEN="$token" bao kv get -field=<key> <mount>/<path>)
   

3. Pick the mount by reachability, not habit. Two KV mounts share identical sub-paths: secrets-external/ for anything reachable from the public internet (a SaaS API key, a third-party webhook secret), secret/ for everything internal-only. Only the mount changes, never the path shape.

4. Prefer an engine over a KV copy. GitHub, AWS, and Slack already mint short-lived credentials on demand — read from the engine (an installation token, an STS session, an OAuth-app token) and never keep a static copy of what it can mint.

5. Never print the value. Capture it into a variable and use the variable — no echo, no curl -v, no dumping the environment to check it landed.

6. A helper that exits 0 having exported nothing is the bug, not a quiet success. If a credential-fetch wrapper reports success but the variable it was supposed to set is empty, report that as a defect — never work around it by hand-typing the value instead.

State warning: which engines are configured differs per environment and changes over time. Verify capability before relying on it (below) — never assume an engine is live because a config flag says enabled. A default is not a running system.