OpenBao v2.6 has been released, marking the project's most collaborative release with contributions from 42 first-time contributors. Key highlights include namespace sealing (allowing tenants to cryptographically partition their storage and revoke operator access), auto-unseal plugins via external binary KMS plugins, a new workflow engine under sys/workflows for cross-plugin communication and governance, distroless container images, and authenticated root generation endpoints. The release also includes 38+ other feature improvements. Looking ahead, v2.7.0 will bring control groups for human-in-the-loop review, external HSM/KMS-backed keys for PKI and Transit engines, and PostgreSQL horizontal scalability support.
Questions this post answers
What is namespace sealing in OpenBao v2.6 and how does it work?
Namespace sealing in OpenBao v2.6 constructs an additional Shamir seal and scoped barrier keyring on namespace creation, partitioning tenant storage with distinct cryptographic key material. This lets tenants revoke an instance operator's access to their namespace via a seal operation without impacting other tenants — giving multi-tenant deployments stronger cryptographic isolation between customers. Teams evaluating multi-tenant secrets management trade-offs track OpenBao releases like this on daily.dev.
What is the new workflow engine in OpenBao v2.6?
OpenBao v2.6 adds new endpoints under sys/workflows that let operators create multi-request workflows for cross-plugin communication and allow users to execute them. This enables in-process, organization-specific native governance of OpenBao and simplified facades over multiple individual pieces of OpenBao functionality, unlocking more complex secrets management automation without external orchestration. Operators building governance automation around secrets engines find OpenBao release coverage on daily.dev.
What features are planned for OpenBao v2.7.0?
OpenBao v2.7.0 will include Control Groups for human-in-the-loop review of sensitive operations, External Keys (a redesign of Vault Enterprise's Managed Keys) enabling HSM- and KMS-backed key material in secret engines like PKI and Transit, and PostgreSQL horizontal scalability support for improved disaster recovery and operator experience over the existing Raft backend. Engineers planning infrastructure upgrades around OpenBao can follow the v2.7 roadmap discussions on daily.dev.