--- title: OpenBao Features - Declarative Configuration | daily.dev description: OpenBao 2.4.0 introduces declarative audit device configuration and declarative self-initialization, letting operators define audit logging and initial setup... canonical: https://daily.dev/posts/openbao-features---declarative-configuration-z8cwjylzs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenBao Features - Declarative Configuration | daily.dev og:description: OpenBao 2.4.0 introduces declarative audit device configuration and declarative self-initialization, letting operators define audit logging and initial setup... og:url: https://daily.dev/posts/openbao-features---declarative-configuration-z8cwjylzs og:image: https://api.daily.dev/og/posts/Z8cWjYLzs.png og:image:alt: OpenBao Features - Declarative Configuration og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenBao Features - Declarative Configuration **[OpenBao](https://daily.dev/sources/openbao)** · 4 min read · 0 upvotes · 0 comments ## Summary OpenBao 2.4.0 introduces declarative audit device configuration and declarative self-initialization, letting operators define audit logging and initial setup state (auth mounts, admin users, policies) entirely through config files rather than API calls. Declarative audit devices can disable API-driven creation to prevent leaked tokens from redirecting audit logs to attackers, addressing a class of Vault RCE vulnerabilities tied to audit config. Self-initialization supports dynamic data sources (env vars, files, request/response chaining, CEL/text templating) and is designed to run only once on first startup, on a single node, with auto-unseal required for full automation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What version of OpenBao added declarative self-initialization and declarative audit device configuration? OpenBao v2.4.0 introduced both declarative self-initialization and declarative audit device creation. These features let operators define OpenBao's initial state, including audit devices and auth mounts, users, and policies, entirely through configuration files rather than sequential API calls, making initial deployment more reproducible. _Track new OpenBao releases like this on daily.dev before rolling out a secrets management upgrade._ ### How does OpenBao prevent a leaked admin token from exfiltrating secrets through audit logs? Operators can disable API-driven audit device creation by setting unsafe_allow_api_audit_creation to false, which is the default. This ensures audit devices, including ones writing to network sockets, can only be configured declaratively by system operators with access to the underlying config files, so a leaked admin token cannot redirect audit logs to an attacker-controlled network destination. _Security teams evaluating secrets managers can follow hardening changes like this via daily.dev._ ### What are the design limitations of OpenBao's self-initialization feature? Self-initialization runs only on first startup so an attacker cannot later modify configuration to gain privileged access, only a single node should perform self-initialization since parallel runs are unsupported and can split-brain a Raft cluster, and operators need auto-unseal configured for the startup to be fully automatic. _daily.dev helps engineers stay current on operational caveats before adopting new secrets vault features._ ## Similar posts on daily.dev - [Announcing OpenBao v2.6\! – Open Source Security Foundation](https://daily.dev/posts/announcing-openbao-v2-6-open-source-security-foundation-2a9rrvhey) · OpenSSF · 1 upvotes · 0 comments - [Announcing OpenBao v2.7\!](https://daily.dev/posts/announcing-openbao-v2-7--emwrpj82p) · OpenBao · 33 upvotes · 2 comments - [OTel Updates: Declarative Config — A Steadier Way to Configure OpenTelemetry SDKs](https://daily.dev/posts/otel-updates-declarative-config-a-steadier-way-to-configure-opentelemetry-sdks-qtucfu4rm) · Last9 · 3 upvotes · 0 comments - [Flux and OpenBao: Secrets and Signatures](https://daily.dev/posts/flux-and-openbao-secrets-and-signatures-frq65jpy5) · Flux · 8 upvotes · 1 comments --- Tags: [#iac](https://daily.dev/tags/iac), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/openbao-features---declarative-configuration-z8cwjylzs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenBao Features - Declarative Configuration","url":"https://daily.dev/posts/openbao-features---declarative-configuration-z8cwjylzs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/openbao-features---declarative-configuration-z8cwjylzs"},"datePublished":"2026-08-23T12:18:50.187Z","dateModified":"2026-08-23T12:29:44.798Z","description":"OpenBao 2.4.0 introduces declarative audit device configuration and declarative self-initialization, letting operators define audit logging and initial setup...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/789c088b01e45c3338fe0d40b1e0075b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/789c088b01e45c3338fe0d40b1e0075b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"OpenBao","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"OpenBao","logo":"https://media.daily.dev/image/upload/s--a91pfYlL--/c_limit,w_256/f_auto,q_auto/v1787487459/logos/openbao?_a=BAMAMicg0","url":"https://daily.dev/sources/openbao"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/openbao-features---declarative-configuration-z8cwjylzs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"iac,secrets-management","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"OpenBao","item":"https://daily.dev/sources/openbao"},{"@type":"ListItem","position":3,"name":"OpenBao Features - Declarative Configuration"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/openbao-features---declarative-configuration-z8cwjylzs#faq","mainEntity":[{"@type":"Question","name":"What version of OpenBao added declarative self-initialization and declarative audit device configuration?","acceptedAnswer":{"@type":"Answer","text":"OpenBao v2.4.0 introduced both declarative self-initialization and declarative audit device creation. These features let operators define OpenBao's initial state, including audit devices and auth mounts, users, and policies, entirely through configuration files rather than sequential API calls, making initial deployment more reproducible. Track new OpenBao releases like this on daily.dev before rolling out a secrets management upgrade."}},{"@type":"Question","name":"How does OpenBao prevent a leaked admin token from exfiltrating secrets through audit logs?","acceptedAnswer":{"@type":"Answer","text":"Operators can disable API-driven audit device creation by setting unsafe_allow_api_audit_creation to false, which is the default. This ensures audit devices, including ones writing to network sockets, can only be configured declaratively by system operators with access to the underlying config files, so a leaked admin token cannot redirect audit logs to an attacker-controlled network destination. Security teams evaluating secrets managers can follow hardening changes like this via daily.dev."}},{"@type":"Question","name":"What are the design limitations of OpenBao's self-initialization feature?","acceptedAnswer":{"@type":"Answer","text":"Self-initialization runs only on first startup so an attacker cannot later modify configuration to gain privileged access, only a single node should perform self-initialization since parallel runs are unsupported and can split-brain a Raft cluster, and operators need auto-unseal configured for the startup to be fully automatic. daily.dev helps engineers stay current on operational caveats before adopting new secrets vault features."}}]} ```