3 ms·

This is great, Vault had a lot of community contributions blocked or stalled due to internal politics/roadmap stuff at HC. I think having a community fork will

This is great, Vault had a lot of community contributions blocked or stalled due to internal politics/roadmap stuff at HC. I think having a community fork will encourage folks to scratch itches that HC was reluctant to add into the product. I know I'd love to add blocking queries and maybe a TPM seal... Additionally, the Vault plugin model is terrible IMO, I wonder if the fork could revisit how it works or add a better abstraction. Lifecycling plugins, especially with container deployments of Vault, is a nightmare.

cipherboy 3y ago
\o do you mind opening issues for these topics for discussion? https://github.com/openbao/openbao/issues/new https://github.com/openbao/openbao/issues/new TPM seal could be addressed with the PKCS#11 TPM bridge (which requires Vault Enterprise). But I'm curious what blocking queries are, as I've not heard of them before... Elaboration on the pain points of plugin lifecycle would definitely be useful :-)
- candiddevmike 3y ago
  Sure, just opened two issues around the blocking queries and plugin interface. I'm not sure how adding Vault Enterprise features like HSM/PKCS#11 into OpenBao will work, could create some legal issues depending on how it's done.
  - cipherboy 3y ago
    Right, sorry, I wasn't implying that the community should or could add PKCS#11 support, just stating that while TPM support is nominally lacking from Vault Enterprise documentation, it is achievable today via PKCS#11 bridge. :-)