8 ms·

HashiCorp Vault forked into OpenBAO

181 points by geerlingguy 3y ago

candiddevmike 3y ago
This is great, Vault had a lot of community contributions blocked or stalled due to internal politics/roadmap stuff at HC. I think having a community fork will encourage folks to scratch itches that HC was reluctant to add into the product. I know I'd love to add blocking queries and maybe a TPM seal... Additionally, the Vault plugin model is terrible IMO, I wonder if the fork could revisit how it works or add a better abstraction. Lifecycling plugins, especially with container deployments of Vault, is a nightmare.
- cipherboy 3y ago
  \o do you mind opening issues for these topics for discussion? https://github.com/openbao/openbao/issues/new https://github.com/openbao/openbao/issues/new TPM seal could be addressed with the PKCS#11 TPM bridge (which requires Vault Enterprise). But I'm curious what blocking queries are, as I've not heard of them before... Elaboration on the pain points of plugin lifecycle would definitely be useful :-)
  - candiddevmike 3y ago
    Sure, just opened two issues around the blocking queries and plugin interface. I'm not sure how adding Vault Enterprise features like HSM/PKCS#11 into OpenBao will work, could create some legal issues depending on how it's done.
    - cipherboy 3y ago
      Right, sorry, I wasn't implying that the community should or could add PKCS#11 support, just stating that while TPM support is nominally lacking from Vault Enterprise documentation, it is achievable today via PKCS#11 bridge. :-)
throwaway129472 3y ago
Hardly surprising that IBM is doing this as they've been commercializing Vault for some time [0]. [0] - https://www.ibm.com/products/secrets-manager https://www.ibm.com/products/secrets-manager Disclosure - I work for HashiCorp and IBM has been mentioned by name in relation to the license change.
- yellow_lead 3y ago
  Care to comment anymore on this? I'm curious what the sentiment is within hashicorp
  - throwaway129472 3y ago
    There's no overall consensus within engineering about the change itself. What is amusing is that most of the public response has been aimed at Terraform whilst internally Terraform wasn't the concern. Gruntworks and the others were not mentioned internally. It was Vault. It was IBM.
    - jsiepkes 3y ago
      Interesting. I'm curious, was it fear of IBM or was there a concrete threat from IBM which was already eating Hashicorp's lunch and was an existential threat? I have a hard time imagining why anyone would choose IBM's offering over Hashicorp's offering unless they would already be up until their necks into IBM stuff. I also wouldn't really expect the IBM and Hashicorp customer base to overlap much?
      - natbennett 3y ago
        “Application Modernization” is a huge deal in enterprise. In practice this means some combination of “make it slightly easier to get production traffic to new Java apps” and “deploy a lot of Kubernetes clusters.” Really they want the former but the k8s became a proxy for the capability. It’s why IBM bought RedHat. Hashicorp products are a very big part of this world. I’d expect that basically every IBM customer also uses Hashicorp products, but they may or may not have a commercial relationship with Hashicorp.
brunoqc 3y ago
I wonder why vault doesn't have more 3rd party tools like password managers (with browser and mobile support). For servers tools, maybe people wrote cool stuff at work but they are not published.
- politelemon 3y ago
  Specifically on password managers, I've looked at it in the past as a backing store for password management, and it's mostly unsuitable. The biggest missing piece back then was lack of a search feature and the maintainers were not interested in implementing it.
  - mdaniel 3y ago
    Well, lucky you, because now there's new management :-) In all seriousness, you may want to open an issue <https://github.com/openbao/openbao/issues https://github.com/openbao/openbao/issues> as they have weighed in on a few threads here saying they're open to suggestions Having implemented a reader for 1Password's "old" opvault format, I would imagine the threat model is not just searching, so it may be a heavy lift to coerce ~~Vault~~ OpenBao's mental model over into one that can be used as a consumer a password manager but I'll admit that would be pretty cool to unify vaultwarden and OpenBao into one stop shopping for all one's cryptographic needs
    - brunoqc 3y ago
      I might be a foolish dreamer, but I think a healthy community with a lot of 3rd party tools make a project even greater. Like git. It also inspires confidence for new adopters. I was often wondering with vault "why are there so few 3rd party tools? Is almost nobody using vault or people just use their own private tools". I was afraid to "invest" by using a tool that I perceived as not being popular enough and maybe have a limited future (maybe just in the 3rd party tools area)
- bogota 3y ago
  It’s a bit overkill for that. Although if you know how to run and set it up it does work just fine for that.
triyambakam 3y ago
The beginning of the end of HashiCorp?
- justinjlynn 3y ago
  The beginning?
Pet_Ant 3y ago
What is left of the big Hashicorp products? Has Consul been forked seriously by anyone?
- geerlingguy 3y ago
  Vagrant too, but it's been on a downward trend for years, probably not enough of a user base to consider maintaining a fork nowadays.
  - Pet_Ant 3y ago
    Vagrant is a dev tool, it’s not mission critical no company will pay for it. Could see a community effort with Patreon. Basically, if it doesn’t deploy into production corporate won’t pay for it.
arcanemachiner 3y ago
The repo is pretty anemic so far, but I starred it anyways: https://github.com/openbao/openbao https://github.com/openbao/openbao Sad to see Hashicorp going this way, they made a lot of great stuff.
- sc0rpil 3y ago
  The development is currently happening under `development` branch while the code is not in build'able state: https://github.com/openbao/openbao/tree/development https://github.com/openbao/openbao/tree/development Very early stage still.
FridgeSeal 3y ago
> details about the project, dubbed OpenBao. Oh interesting, I wonder who did it. > co-founder and CEO of DevOps automation biz Scalr and one of the organizers of OpenTofu, a fork of Terraform Yeah, alright then. Does nobody else find it even slightly on-the-nose that the guy behind the TF fork just happens to also run a devops company himself? > Blatantly take someone else’s work > mobilise the community by calling them hostile because of licensing > spin up a business to build on the community > make bank Now I’m not saying that what’s happened, but I am saying it sure does smell funny.
- bogantech 3y ago
  [flagged]
- TAForObvReasons 3y ago
  This seems to ignore the first part of the story, where Hashicorp builds up a community around an open source project and relicenses the project. OpenTofu and now OpenBao wouldn't have happened if Hashicorp didn't relicense in the first place.
  - bogantech 3y ago
    The license change wouldn't have happened without the leeches either
  - FridgeSeal 3y ago
    You don’t think that the licence changes were intended exactly these scenarios? Because it sure seems to me that they were. The vast majority of users were, and are, completely unaffected by the licence changes. You’re really only affected if you are selling TF services commercially.
    - evv 3y ago
      Welcome to Open Source, where being actually open is a competitive advantage! If you want users of your software to have the brightest future, you need to accept the fact that others can make money and services with your code. If you try to shut that down, people will fork the most recent version of your code that has an OSI compatible license. Of course, they could have chosen a license like AGPL in the first place, which prohibits services with non-AGPL changes. But then, the product would have been less likely to have the viral growth that HC products enjoyed.
JCharante 3y ago
If there's a security flaw present in the original and fork, how do you write a patch to the same bug without writing identical code? How do you avoid accidentally being influenced by Business Source License code, especially as devs start using LLMs that may ingest that code in their training data?
- JCharante 3y ago
  I'm not trying to discourage the project, this is just a genuine question for any project that has 2 "open source" versions that are very alike
  - mnahkies 3y ago
    The scenario you present in the parent comment has echoes of https://en.m.wikipedia.org/wiki/Google_LLC_v._Oracle_America,_Inc https://en.m.wikipedia.org/wiki/Google_LLC_v._Oracle_America.... - if I recall correctly they did "clean room" re-implementations of the same public API surfaces which in some cases resulted in identical implementations. To my understanding if some piece of code is the only / obvious way to solve a problem it's not an issue. To use a trivial example there's only so many ways you can implement a sum contents of array function, I'd imagine for many security vulnerabilities it'll be similar - adding a bounds check or whatever isn't going to be problematic just because you weren't first.
    - JCharante 3y ago
      Okay, nice. I didn't know there were identical implementations in that case, I just thought it was about the method signatures being identical (because that's necessary when it's API Compatible).
sc0rpil 3y ago
Hey HN, I'm involved with this project, glad you found it interesting! Keep in mind it's still a _very_ early stage and not in a usable state. A lot of work in progress but also plenty of opportunities if you want to contribute. If you want to help out, you can : Join Matrix rooms: - https://chat.lfx.linuxfoundation.org/#/room/#openbao-announcements:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-announc... - https://chat.lfx.linuxfoundation.org/#/room/#openbao-development:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-develop... - https://chat.lfx.linuxfoundation.org/#/room/#openbao-general:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-general... - https://chat.lfx.linuxfoundation.org/#/room/#openbao-questions:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-questio... - https://chat.lfx.linuxfoundation.org/#/room/#openbao-random:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-random:... Join the mailing list: https://lists.lfedge.org/g/openbao https://lists.lfedge.org/g/openbao
mdekkers 3y ago
Awesome, couldn’t have happened to _nicer_ people. Now do Consul and Nomad!
- thenipper 3y ago
  I’d definitely like this for nomad. We just started using it at work to manage running jobs on a heterogenous group of machines and it’s really a great product.
  - mdekkers 3y ago
    Nomad is really pretty awesome
  - jen20 3y ago
    “This product is awesome and I’d using it to make money! Wouldn’t it be awful if the team behind it wasn’t paid because of dumb entitlement?” Fixed that for you. You’re right, Nomad is awesome, precisely because it has a way different governance model than Kubernetes and other similar products. It’s a cathedral, not a midden.
- mdaniel 3y ago
  I can't discern how many are just those "dependabot" bumps but the 1400 forks show some are active https://github.com/hashicorp/nomad/forks?include=active&page=1&period=1mo&sort_by=stargazer_counts https://github.com/hashicorp/nomad/forks?include=active&page... including CircleCI who I would think have a stake in a libre Nomad https://github.com/circleci/nomad/tree/circleci/release-1.5.10 https://github.com/circleci/nomad/tree/circleci/release-1.5.... Now maybe their goals don't align with the community, and/or they don't want to be in the maintainer business for such a project, but better than nothing
vmatsiiako 3y ago
Given how much of a PITA Vault is, I think it's time for people to move on from it (especially that I'm hearing this is financed by IMB to keep their Vault competitor going). There are other great/better options. Check out Infisical for secret management: https://github.com/Infisical/infisical https://github.com/Infisical/infisical Disclaimer: I'm one of the maintainers.
mdaniel 3y ago
current discussion on the actual repo's URL: https://news.ycombinator.com/item?id=38579130 https://news.ycombinator.com/item?id=38579130

181 points by geerlingguy 3y ago

This is great, Vault had a lot of community contributions blocked or stalled due to internal politics/roadmap stuff at HC. I think having a community fork will encourage folks to scratch itches that HC was reluctant to add into the product. I know I'd love to add blocking queries and maybe a TPM seal... Additionally, the Vault plugin model is terrible IMO, I wonder if the fork could revisit how it works or add a better abstraction. Lifecycling plugins, especially with container deployments of Vault, is a nightmare.

cipherboy 3y ago
\o do you mind opening issues for these topics for discussion? https://github.com/openbao/openbao/issues/new https://github.com/openbao/openbao/issues/new TPM seal could be addressed with the PKCS#11 TPM bridge (which requires Vault Enterprise). But I'm curious what blocking queries are, as I've not heard of them before... Elaboration on the pain points of plugin lifecycle would definitely be useful :-)
- candiddevmike 3y ago
  Sure, just opened two issues around the blocking queries and plugin interface. I'm not sure how adding Vault Enterprise features like HSM/PKCS#11 into OpenBao will work, could create some legal issues depending on how it's done.
  - cipherboy 3y ago
    Right, sorry, I wasn't implying that the community should or could add PKCS#11 support, just stating that while TPM support is nominally lacking from Vault Enterprise documentation, it is achievable today via PKCS#11 bridge. :-)

throwaway129472 3y ago

Hardly surprising that IBM is doing this as they've been commercializing Vault for some time [0]. [0] - https://www.ibm.com/products/secrets-manager https://www.ibm.com/products/secrets-manager Disclosure - I work for HashiCorp and IBM has been mentioned by name in relation to the license change.

yellow_lead 3y ago
Care to comment anymore on this? I'm curious what the sentiment is within hashicorp
- throwaway129472 3y ago
  There's no overall consensus within engineering about the change itself. What is amusing is that most of the public response has been aimed at Terraform whilst internally Terraform wasn't the concern. Gruntworks and the others were not mentioned internally. It was Vault. It was IBM.
  - jsiepkes 3y ago
    Interesting. I'm curious, was it fear of IBM or was there a concrete threat from IBM which was already eating Hashicorp's lunch and was an existential threat? I have a hard time imagining why anyone would choose IBM's offering over Hashicorp's offering unless they would already be up until their necks into IBM stuff. I also wouldn't really expect the IBM and Hashicorp customer base to overlap much?
    - natbennett 3y ago
      “Application Modernization” is a huge deal in enterprise. In practice this means some combination of “make it slightly easier to get production traffic to new Java apps” and “deploy a lot of Kubernetes clusters.” Really they want the former but the k8s became a proxy for the capability. It’s why IBM bought RedHat. Hashicorp products are a very big part of this world. I’d expect that basically every IBM customer also uses Hashicorp products, but they may or may not have a commercial relationship with Hashicorp.

brunoqc 3y ago

I wonder why vault doesn't have more 3rd party tools like password managers (with browser and mobile support). For servers tools, maybe people wrote cool stuff at work but they are not published.

politelemon 3y ago
Specifically on password managers, I've looked at it in the past as a backing store for password management, and it's mostly unsuitable. The biggest missing piece back then was lack of a search feature and the maintainers were not interested in implementing it.
- mdaniel 3y ago
  Well, lucky you, because now there's new management :-) In all seriousness, you may want to open an issue <https://github.com/openbao/openbao/issues https://github.com/openbao/openbao/issues> as they have weighed in on a few threads here saying they're open to suggestions Having implemented a reader for 1Password's "old" opvault format, I would imagine the threat model is not just searching, so it may be a heavy lift to coerce ~~Vault~~ OpenBao's mental model over into one that can be used as a consumer a password manager but I'll admit that would be pretty cool to unify vaultwarden and OpenBao into one stop shopping for all one's cryptographic needs
  - brunoqc 3y ago
    I might be a foolish dreamer, but I think a healthy community with a lot of 3rd party tools make a project even greater. Like git. It also inspires confidence for new adopters. I was often wondering with vault "why are there so few 3rd party tools? Is almost nobody using vault or people just use their own private tools". I was afraid to "invest" by using a tool that I perceived as not being popular enough and maybe have a limited future (maybe just in the 3rd party tools area)
bogota 3y ago
It’s a bit overkill for that. Although if you know how to run and set it up it does work just fine for that.

triyambakam 3y ago

The beginning of the end of HashiCorp?

justinjlynn 3y ago
The beginning?

Pet_Ant 3y ago

What is left of the big Hashicorp products? Has Consul been forked seriously by anyone?

geerlingguy 3y ago
Vagrant too, but it's been on a downward trend for years, probably not enough of a user base to consider maintaining a fork nowadays.
- Pet_Ant 3y ago
  Vagrant is a dev tool, it’s not mission critical no company will pay for it. Could see a community effort with Patreon. Basically, if it doesn’t deploy into production corporate won’t pay for it.

arcanemachiner 3y ago

The repo is pretty anemic so far, but I starred it anyways: https://github.com/openbao/openbao https://github.com/openbao/openbao Sad to see Hashicorp going this way, they made a lot of great stuff.

sc0rpil 3y ago
The development is currently happening under `development` branch while the code is not in build'able state: https://github.com/openbao/openbao/tree/development https://github.com/openbao/openbao/tree/development Very early stage still.

FridgeSeal 3y ago

> details about the project, dubbed OpenBao. Oh interesting, I wonder who did it. > co-founder and CEO of DevOps automation biz Scalr and one of the organizers of OpenTofu, a fork of Terraform Yeah, alright then. Does nobody else find it even slightly on-the-nose that the guy behind the TF fork just happens to also run a devops company himself? > Blatantly take someone else’s work > mobilise the community by calling them hostile because of licensing > spin up a business to build on the community > make bank Now I’m not saying that what’s happened, but I am saying it sure does smell funny.

bogantech 3y ago
[flagged]
TAForObvReasons 3y ago
This seems to ignore the first part of the story, where Hashicorp builds up a community around an open source project and relicenses the project. OpenTofu and now OpenBao wouldn't have happened if Hashicorp didn't relicense in the first place.
- bogantech 3y ago
  The license change wouldn't have happened without the leeches either
- FridgeSeal 3y ago
  You don’t think that the licence changes were intended exactly these scenarios? Because it sure seems to me that they were. The vast majority of users were, and are, completely unaffected by the licence changes. You’re really only affected if you are selling TF services commercially.
  - evv 3y ago
    Welcome to Open Source, where being actually open is a competitive advantage! If you want users of your software to have the brightest future, you need to accept the fact that others can make money and services with your code. If you try to shut that down, people will fork the most recent version of your code that has an OSI compatible license. Of course, they could have chosen a license like AGPL in the first place, which prohibits services with non-AGPL changes. But then, the product would have been less likely to have the viral growth that HC products enjoyed.

JCharante 3y ago

If there's a security flaw present in the original and fork, how do you write a patch to the same bug without writing identical code? How do you avoid accidentally being influenced by Business Source License code, especially as devs start using LLMs that may ingest that code in their training data?

JCharante 3y ago
I'm not trying to discourage the project, this is just a genuine question for any project that has 2 "open source" versions that are very alike
- mnahkies 3y ago
  The scenario you present in the parent comment has echoes of https://en.m.wikipedia.org/wiki/Google_LLC_v._Oracle_America,_Inc https://en.m.wikipedia.org/wiki/Google_LLC_v._Oracle_America.... - if I recall correctly they did "clean room" re-implementations of the same public API surfaces which in some cases resulted in identical implementations. To my understanding if some piece of code is the only / obvious way to solve a problem it's not an issue. To use a trivial example there's only so many ways you can implement a sum contents of array function, I'd imagine for many security vulnerabilities it'll be similar - adding a bounds check or whatever isn't going to be problematic just because you weren't first.
  - JCharante 3y ago
    Okay, nice. I didn't know there were identical implementations in that case, I just thought it was about the method signatures being identical (because that's necessary when it's API Compatible).

sc0rpil 3y ago

Hey HN, I'm involved with this project, glad you found it interesting! Keep in mind it's still a _very_ early stage and not in a usable state. A lot of work in progress but also plenty of opportunities if you want to contribute. If you want to help out, you can : Join Matrix rooms: - https://chat.lfx.linuxfoundation.org/#/room/#openbao-announcements:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-announc... - https://chat.lfx.linuxfoundation.org/#/room/#openbao-development:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-develop... - https://chat.lfx.linuxfoundation.org/#/room/#openbao-general:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-general... - https://chat.lfx.linuxfoundation.org/#/room/#openbao-questions:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-questio... - https://chat.lfx.linuxfoundation.org/#/room/#openbao-random:chat.lfx.linuxfoundation.org https://chat.lfx.linuxfoundation.org/#/room/#openbao-random:... Join the mailing list: https://lists.lfedge.org/g/openbao https://lists.lfedge.org/g/openbao

mdekkers 3y ago

Awesome, couldn’t have happened to _nicer_ people. Now do Consul and Nomad!

thenipper 3y ago
I’d definitely like this for nomad. We just started using it at work to manage running jobs on a heterogenous group of machines and it’s really a great product.
- mdekkers 3y ago
  Nomad is really pretty awesome
- jen20 3y ago
  “This product is awesome and I’d using it to make money! Wouldn’t it be awful if the team behind it wasn’t paid because of dumb entitlement?” Fixed that for you. You’re right, Nomad is awesome, precisely because it has a way different governance model than Kubernetes and other similar products. It’s a cathedral, not a midden.
mdaniel 3y ago
I can't discern how many are just those "dependabot" bumps but the 1400 forks show some are active https://github.com/hashicorp/nomad/forks?include=active&page=1&period=1mo&sort_by=stargazer_counts https://github.com/hashicorp/nomad/forks?include=active&page... including CircleCI who I would think have a stake in a libre Nomad https://github.com/circleci/nomad/tree/circleci/release-1.5.10 https://github.com/circleci/nomad/tree/circleci/release-1.5.... Now maybe their goals don't align with the community, and/or they don't want to be in the maintainer business for such a project, but better than nothing

vmatsiiako 3y ago

Given how much of a PITA Vault is, I think it's time for people to move on from it (especially that I'm hearing this is financed by IMB to keep their Vault competitor going). There are other great/better options. Check out Infisical for secret management: https://github.com/Infisical/infisical https://github.com/Infisical/infisical Disclaimer: I'm one of the maintainers.

mdaniel 3y ago

current discussion on the actual repo's URL: https://news.ycombinator.com/item?id=38579130 https://news.ycombinator.com/item?id=38579130