RFCs

The following is a list of Requests for Comments (RFCs, a form of design documentation) agreed upon by the community and the OpenBao Technical Steering Committee.

Landed

• Paginated lists, for adding pagination to the user-facing API and storage backends. This landed in PR #170.
• mlock removal, to remove the mlock syscall from OpenBao. This landed in PR #363.
• Discontinue enforcing signed commits, for allowing users to contribute without GPG/SSH signing their commits.
• Transactional storage, for supporting safer storage semantics in physical.Backend and logical.Storage for use by Core and plugins. This landed in several parts concluding in PR #292.
• SCAN operation, for supporting recursive lists as a native operation and as an ACL capability. This landed in PR #763.
• ACME TLS Listeners, for supporting just-in-time certificate acquisition for TLS-enabled listeners via the ACME protocol.
• Safely limit pagination via ACL policies, adding a new ACL policy parameter, pagination_limit, to restrict the size of list and scan operation requests.
• Split the mount table using transactional storage, removes mount table limits, allowing potentially hundreds of thousands of mounts on a single scaled-up server. This landed in 622.
• SSH CA Multi-issuer, adds support for multiple issuers on SSH secret engine mounts. Landed in 880.
• Best Practices for Integrating CEL in Auth, Secrets, and Elsewhere, to discuss how Google's Common Expression Language should be integrated into OpenBao.
• Using CEL Roles For JWT/OIDC Auth, adds support for CEL roles in JWT Auth Landed in 769