RUNNING OPENBAO ON KUBERNETES WITH A CLOUDNATIVEPG POSTGRESQL BACKEND

Summary from the TLDR DevOps newsletter

OpenBao and CloudNativePG can manage infrastructure secrets on Kubernetes without vendor lock-in by using certificate authentication and synchronous replication. OpenBao uses the CloudNativePG PostgreSQL cluster as an encrypted key-value store, and a schema-init job revokes default public permissions to lock down the database. CloudNativePG automatically renews client certificates every 90 days, but OpenBao requires a rolling restart to load the new files. The setup runs three OpenBao replicas and three Postgres instances across separate nodes.