External Keys
Within certain environments, users want to leverage key management systems external to OpenBao, when handling, storing, and interacting with sensitive key material, or are required to do so by standards requirements. To satisfy these requirements, OpenBao has a centralized abstraction called External Keys that different secrets engines can plug into, allowing them to delegate these operations to a trusted external KMS or HSM.
External Keys are OpenBao's equivalent of Vault Enterprise's Managed Keys feature. External Keys are a redesign of Managed Keys with the intent of providing greater flexibility. As such, the two are not API-compatible but achieve the same high-level goal of delegating sensitive key operations to external systems.
Backend support
External Keys support arbitrary backends by making use of OpenBao's plugin system. KMS plugins can implement the APIs required to support External Keys alongside or independently of Auto Unseal support.
See the plugin overview for supported KMS plugins, and see the go-kms-wrapping repository for documentation and instructions on KMS plugin development.
Secrets and auth engine support
The PKI Secrets Engine integrates with External Keys to offer certificate signing via both root and intermediary PKI paths, leveraging private keys from an external trusted KMS/HSM.
The Transit Secrets Engine integrates with External Keys to create and verify cryptographic signatures, and to encrypt and decrypt data, offloading operations to the KMS or HSM that hosts the External Key material.
In the future, OpenBao may allow other engines installed as plugins to interact with External Keys.
API
External Keys are managed over the HTTP API. Please see
/sys/external-keys for more details.
Namespace support
The /sys/external-keys APIs are separated per-namespace. A secrets or auth
engine in a given namespace can only access External Keys that were configured
within the same namespace.