RFCs

The following is a list of Requests for Comments (RFCs, a form of design documentation) agreed upon by the community and the OpenBao Technical Steering Committee.

Accepted

• External Key Configuration for KMS and HSM Access, to add support for secure key material storage and interaction from secrets engines like PKI, Transit, and SSH.
• Components for efficient search over encrypted data, adds the necessary constructs to build indexes on data efficiently allowing for faster search operations.
• Emergency Seal, for adding a secondary Shamir's seal as a "break-glass" recovery path for auto-seal failures.
• Parallel Unseal, for adding additional unseal mechanisms for improved availability when one or more auto-unseal devices are offline.
• Plugin Management Improvements, addressing several pain points around plugin binary management to improve the operator experience that comes with an increasingly plugin-focused OpenBao.

Landed

• Authenticated rekey, to make the rekey root and rekey recovery keys endpoints authenticated and additionally authorized by a token and its policy.
• Declarative Self-Initialization, to allow operators to define initial mounts, auth, policies, and audit logs from a static configuration applied once on early startup, preventing the need to call manual sys/init except with manual unseal mechanisms.
• Paginated lists, for adding pagination to the user-facing API and storage backends. This landed in PR #170.
• mlock removal, to remove the mlock syscall from OpenBao. This landed in PR #363.
• Discontinue enforcing signed commits, for allowing users to contribute without GPG/SSH signing their commits.
• Transactional storage, for supporting safer storage semantics in physical.Backend and logical.Storage for use by Core and plugins. This landed in several parts concluding in PR #292.
• SCAN operation, for supporting recursive lists as a native operation and as an ACL capability. This landed in PR #763.
• ACME TLS Listeners, for supporting just-in-time certificate acquisition for TLS-enabled listeners via the ACME protocol. This landed in PR #857.
• Safely limit pagination via ACL policies, adding a new ACL policy parameter, pagination_limit, to restrict the size of list and scan operation requests. This landed in PR #802.
• Split the mount table using transactional storage, removes mount table limits, allowing potentially hundreds of thousands of mounts on a single scaled-up server. This landed in 622.
• SSH CA Multi-issuer, adds support for multiple issuers on SSH secret engine mounts. Landed in 880.
• Using CEL Roles For JWT/OIDC Auth, adds support for CEL roles in JWT Auth Landed in 769
• Using CEL Roles For PKI cert issuance/sign policies, adds support for CEL roles in PKI Landed in 794
• Filtering list and scan results to only results visible by the client token. This landed in PR #1389.
• Static Auto-Unseal, introducing a new auto-unseal mechanism, static, which loads keys from the environment, filesystem, or directly in the configuration file. Landed in PR #1425.
• Support inline authentication for non-leased operations, to discuss how to incorporate authentication sent via the main operation, without returning or storing the resulting token, for operations that do not create leases. Landed in PR #1433.
• Define audit devices in the configuration file, solving the security and usability gaps after HCSEC-2025-14. Landed in PR #1700.
• Define plugins in the configuration file, solving automatic distribution of plugins and eventually leading to a path to minimization of the bao server binary.
• Auto Unseal Plugins, enabling distribution of Auto Unseal providers as external plugin binaries to reduce dependency creep and ease integration of new KMS providers.
• Standby nodes handle read requests, to allow standby nodes in a high-availability setup to handle read requests directly, improving horizontal scalability.
• Implementation of Invalidation for Raft, for read-enabled standby nodes. This was part of the horizontal scalability implementation.
• Per-Namespace Sealing, to add per-tenant encryption key separation.
• GRPC-Based Invalidation, for providing read scalability on non-Raft HA storage backends which expose an underlying index consistent between different nodes.
• Control Groups, for allow/deny access to a path by a second-party control group
• Index Headers for Consistency, allowing clients to ensure strict consistency in horizontal scalability's eventual consistency environment even when talking to a standby node.

Strategic

• Best Practices for Integrating CEL in Auth, Secrets, and Elsewhere, to discuss how Google's Common Expression Language should be integrated into OpenBao.
• Better Operationalizing the PostgreSQL Storage Engine, to discuss iterating and improving this storage engine to make it more scalable and fit more production environments.
• Post-Quantum Cryptography Migration Roadmap, for mapping out what needs to happen to make OpenBao adopt PQC and what our cryptographic inventory looks like.

Archived

• Web UI Modernization, for rewriting OpenBao’s web UI from EmberJS to React to create a modern, secure, and extensible interface.
• Switch to OpenTelemetry, to replace the current metrics based on go-metrics with OpenTelemetry based metrics.