Step 2: Setting Up OpenBao

OpenBao is a secret manager we will use as a backend for external secrets. As the focus of this lab is the external-secrets part of the story, we will keep the setup very simple and use the development mode. If you would like to use OpenBao in production, please take a closer look on their documentation and make yourself familiar with it.

To install OpenBao, we will also use Helm. The following command will install OpenBao in a namespace called openbao and will enable the development mode, which sets a simple root token and is not persistent in our case.

helm repo add openbao https://openbao.github.io/openbao-helm
helm install -n openbao --create-namespace --wait openbao openbao/openbao --set "server.dev.enabled=true"

After some time, OpenBao should be installed. To find out if everything technically works as expected, you can take a look at all of the relevant objects in the namespace with the command kubectl get all. Furthermore, it is a good idea to inspect the logs of OpenBao using the following command.

kubectl logs -n openbao openbao-0

This will display the output of the OpenBao initialization sequence. You might notice that there is a root token root out there. Furthermore, OpenBao is already unsealed in the development mode, which helps us getting started a bit faster.

When sealed, OpenBao’s storage is encrypted and secrets are inaccessible. Unsealing provides enough key shares to reconstruct the master key, decrypt the barrier, and load the data‑encryption key into memory. In this lab (dev mode) it’s already unsealed; in production, you initialize once to create key shares and, after restarts, present the required number of shares to unseal. Seal state and unseal operations should be handled via your standard operational procedure (UI, automation, or CLI) outside the scope of this lab.

To interact with OpenBao using the browser or the CLI, start a port-forwarding to the OpenBao Pod.

kubectl port-forward -n openbao openbao-0 8200:8200

Please leave this port-forwarding open throughout the next steps, as we will create and change secrets. Now you should be able to access OpenBao using your browser on the URL https://localhost:8200 and the root token.

Nevertheless, we will use the command line tool for the next steps. Please open a new shell (or tab in your terminal emulator) for the next steps.

Configure the OpenBao CLI

As stated in the pre-requisites part, you should already have the OpenBao CLI installed. If this isn't already the case, please follow the steps here.

The first thing needed to interact with OpenBao using the CLI is to tell the tool where the OpenBao server is and to login to it. As we opened a port-forwarding to it, the server is accessible via localhost here. Please also keep in mind that although we can access the pod, OpenBao is not exposed publicly and we can only access it in the cluster.

export BAO_ADDR='http://[::]:8200'
bao login

After executing these commands, you should see a message that you successfully logged in to OpenBao, similar to this.

Now, we can interact with our instance and prepare everything to get started.

Create a new token

First, we would be able to use the root token provided by OpenBao, which would be perfectly fine for this demo use-case. Nevertheless, to give you an idea on how to create a new token, let's take another step and create a token for our external secrets efforts.

bao token create

This command will create a new token, we will use later to access our instance. If everything went fine, you should see the following output:

Please note, that this is also a root token with lots of permissions. For production-ready setups, define policies and follow principles of least privilege there

In the next step, let's create a new secret we'll use to start with external secrets later.

Create a new secret

Creating a new secret is straight forward. Things to notice here are that OpenBao has multiple secrets engines to deal with secrets. One of them is the K/V secrets engine used to store key-value pairs. Furthermore, OpenBao stores its secrets in paths, for secrets this starts with secret and each secret can contain multiple key-value pairs. To create our first secret, use the following command.

bao kv put secret/my-secret key=value

This command creates a secret my-secret to the path secret and adds a key named key with a value value in it. Now the secret is created and you should see the following output:

==== Secret Path ====
secret/data/my-secret

======= Metadata =======
Key                Value
---                -----
created_time       2025-08-30T06:06:04.057326361Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            1

Obviously, you should be able to access your secret now.

Read the new secret

The most simple ways on how to access your secrets are via the Web UI mentioned in the beginning of this step, or via the CLI. As we are already working with the CLI, we can access our newly created secret using this command:

bao kv get secret/my-secret

You should see the key and value of the secret now, as follows:

==== Secret Path ====
secret/data/my-secret

======= Metadata =======
Key                Value
---                -----
created_time       2025-08-30T06:06:04.057326361Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            1

=== Data ===
Key    Value
---    -----
key    value

With this, you've got a secret store that helps you securely storing your secrets. As mentioned before, the dev-mode we used here is not intended for production-use. If you want to dive deeper into OpenBao, take a look into their docs.

Now we should have everything to get started using secrets in Kubernetes, using the external secrets operator.