Source: InfoQ
OpenBao, the community fork of HashiCorp Vault that is now governed under the Linux Foundation’s Open Source Security Foundation, has released version 2.7, and it is a milestone worth noticing for anyone running secrets infrastructure. The release adds PostgreSQL horizontal scalability, external HSM and KMS-backed key support and post-quantum cryptography, along with control groups that require a second party to approve access to sensitive paths.
What is new in 2.7
The external keys feature lets the PKI and Transit secrets engines use key material held in a hardware security module or key management service rather than stored inside OpenBao itself. For organisations that must keep root certificate authority keys under hardware control, that capability used to sit behind Vault’s enterprise licence.
The post-quantum work adds the ML-DSA and ML-KEM algorithms to TLS listeners, certificate authentication, PKI and Transit. It does not make a deployment quantum-safe on its own, since clients, certificate authorities and surrounding systems must also support the algorithms, but it gives operators a practical route to begin testing hybrid and post-quantum configurations before government transitions expected around 2030. That matters because traffic encrypted today could be recorded and decrypted later.
On the scalability side, standby OpenBao instances using the PostgreSQL storage backend can now serve reads, extending work previously done for the integrated Raft backend. The release also carries breaking changes: vendor-specific auto-unseal mechanisms for Alibaba Cloud, AWS, Azure, Google Cloud and Oracle Cloud have moved to external plugins, Kerberos, LDAP and RADIUS authentication moved to the plugins repository, and the file storage backend has been removed because it was never recommended for production.
Why European teams should care
OpenBao follows the same pattern that produced OpenTofu from Terraform and Valkey from Redis: a community fork created after a licence change, now maturing into a credible alternative rather than a protest project. It is distributed under the MPL 2.0 licence, retains API compatibility with Vault for many use cases, and commercial support is emerging, with vendors such as ControlPlane offering hardened, supported OpenBao distributions. For European organisations weighing vendor lock-in, supply chain assurance and the coming post-quantum migration, secrets management is a foundational dependency where open governance now has a strong answer.
If your team runs Vault or is planning secrets infrastructure and wants independent advice on OpenBao, post-quantum readiness or a migration path, contact the team at Excello Digital for DevOps consulting and security architecture reviews.