Migrate From Azure Key Vault to OpenBao on Akamai Cloud

OpenBao is an open source secrets management tool and fork of HashiCorp Vault that provides teams control over how secrets are stored, encrypted, and accessed. OpenBao can be self-hosted in any environment, including on-premises and across multiple clouds.

Azure Key Vault is a managed secrets service that secures secrets, keys, and certificates for application security and compliance on the Microsoft Azure platform. It provides centralized control and access policies so that developers and security teams can safeguard sensitive information such as API keys or passwords.

This guide provides steps and considerations for how to migrate secrets stored in Azure Key Vault to OpenBao running on Akamai Cloud.

Before You Begin

1. Follow our Get Started guide to create an Akamai Cloud account if you do not already have one.

2. When migrating from Azure Key Vault to OpenBao on Akamai Cloud, OpenBao should be deployed before you begin. OpenBao can be installed on a single Linode instance or deployed to a multi-node cluster using Linode Kubernetes Engine (LKE). Follow the appropriate guide below based on your production needs:

   • Deploying OpenBao on a Linode Instance
   • Deploy OpenBao on Linode Kubernetes Engine
   • Deploying OpenBao through the Linode Marketplace

3. Ensure that you have access to your Azure cloud platform account with sufficient permissions to work with Azure Key Vault. The Azure CLI must also be installed and configured.

4. Install jq, a lightweight command line JSON processor.

Using This Guide

This tutorial contains a number of placeholders that are intended to be replaced by your own unique values. For reference purposes, the table below lists these placeholders, what they represent, and the example values used in this guide:

Review Existing Secrets in Azure Key Vault

Before migrating to OpenBao, evaluate how your organization currently uses Azure Key Vault.

For example, an application that uses third-party services (e.g. an LLM platform or digital payment processor) might retrieve API keys at runtime using a role assignment. This ensures the keys aren’t embedded into application images or checked into source control.

OpenBao offers similar capabilities using role-based access, dynamic injection, and integration with Kubernetes.

Review Secrets Using the Azure Portal

1. Navigate to your key vault and open the Secrets tab. The example secrets below are used throughout this guide:

2. To display a secret’s value, select the secret, choose the latest version, and then click Show Secret Value:

Review Secrets Using the Azure CLI

You can also use the Azure CLI (az) to manage the secrets in your key vault.

1. List all the secrets in your vault by specifying the AZURE_VAULT_NAME (e.g. my-app-vault):

   az keyvault secret list \
     --vault-name "AZURE_VAULT_NAME" \
     --query "[].name"

   For Example:

   az keyvault secret list \
     --vault-name "my-app-vault" \
     --query "\[\].name"

   [
     "github-deploy-key",
     "LLM-service-key",
     "payments-service-dev-key",
     "telemetry-export-api-key"
   ]

2. Retrieve the value of a single secret by providing both the AZURE_VAULT_NAME and AZURE_SECRET_NAME (e.g. LLM-service-key).

   az keyvault secret show \
     --vault-name "AZURE_VAULT_NAME" \
     --name "AZURE_SECRET_NAME" \
     --query "value"

   For Example:

   az keyvault secret show \
     --vault-name "my-app-vault" \
     --name "LLM-service-key" \
     --query "value"

   "0z7NUSJ6gHKoWLkO5q2%Zq1E1do%m&RSa47jljP4nMVs7qG#n87Lai46niZUCrLP"

Access Your OpenBao Deployment on Akamai Cloud

The following steps focus on migrating secrets into your OpenBao deployment on Akamai Cloud. You should already have a running OpenBao instance on either a standalone Linode instance, in an LKE cluster, or deployed via the Linode Marketplace.

If your OpenBao environment is not yet ready, refer to the appropriate deployment guide listed in the Before You Begin section and complete the setup.

Once deployed, log into your OpenBao environment. Before continuing, verify that:

• OpenBao is successfully initialized.
• The vault is unsealed.
• The BAO_ADDR environment variable is set.
• You are authenticated using the root token.

Create a Policy and AppRole

Use AppRoles to replicate Azure’s IAM-based access control in OpenBao. In Azure Key Vault, access is granted to users or services through role assignments, such as the Key Vault Secrets User role. In OpenBao, equivalent functionality is implemented using policies attached to AppRoles.

Follow these steps to create an OpenBao AppRole that mirrors the access control model used in Azure IAM.

Enable AppRole

1. Enable the AppRole authentication method:

   bao auth enable approle

   Success! Enabled approle auth method at: approle/

Create a Policy

2. Using a text editor like nano, create a new .hcl policy file in /etc/openbao, replacing POLICY_FILE (e.g. api-keys-secrets-policy.hcl) with a policy filename of your choosing:

   sudo nano /etc/openbao/POLICY_FILE

   For Example:

   sudo nano /etc/openbao/api-keys-secrets-policy.hcl

3. Give the file the following contents, replacing SECRET_MOUNT_PATH (e.g. api-keys) with your chosen mount path:

   File: POLICY_FILE.hcl

   1 2 3

   path "SECRET_MOUNT_PATH/*" { capabilities = ["read"] }

   For Example:

   File: api-keys-secrets-policy.hcl

   1 2 3

   path "api-keys/*" { capabilities = ["read"] }

   This policy grants read access to any secrets within the specified mount path.

   When done, press CTRL+X, followed by Y then Enter to save the file and exit nano.

4. Add the policy to OpenBao, replacing POLICY_NAME (e.g. api-keys-secrets-policy) and POLICY_FILE:

   bao policy write POLICY_NAME /etc/openbao/POLICY_FILE

   For Example:

   bao policy write api-keys-secrets-policy /etc/openbao/api-keys-secrets-policy.hcl

   Success! Uploaded policy: api-keys-secrets-policy

Create an AppRole

5. Create an AppRole for the application that needs access to the secret, replacing APPROLE_NAME (e.g. api-key-reader-approle) and POLICY_NAME:

   bao write auth/approle/role/APPROLE_NAME token_policies=POLICY_NAME

   For Example:

   bao write auth/approle/role/api-key-reader-approle token_policies=api-keys-secrets-policy

   Success! Data written to: auth/approle/role/api-key-reader-approle

6. Verify that the AppRole was written successfully, replacing APPROLE_NAME:

   bao read auth/approle/role/APPROLE_NAME

   For Example:

   bao read auth/approle/role/api-key-reader-approle

   Key                        Value
   ---                        -----
   bind_secret_id             true
   local_secret_ids           false
   secret_id_bound_cidrs      <nil>
   secret_id_num_uses         0
   secret_id_ttl              0s
   token_bound_cidrs          []
   token_explicit_max_ttl     0s
   token_max_ttl              0s
   token_no_default_policy    false
   token_num_uses             0
   token_period               0s
   token_policies             [api-keys-secrets-policy]
   token_strictly_bind_ip     false
   token_ttl                  0s
   token_type                 default

7. Fetch the AppRole ID, replacing APPROLE_NAME:

   bao read auth/approle/role/APPROLE_NAME/role-id

   For Example:

   bao read auth/approle/role/api-key-reader-approle/role-id

   Key        Value
   ---        -----
   role_id    e633701e-893e-460d-8012-ea2afedbcd87

Generate a Secret ID

8. Generate a secret ID for the role, replacing APPROLE_NAME:

   bao write -f auth/approle/role/APPROLE_NAME/secret-id

   For Example:

   bao write -f auth/approle/role/api-key-reader-approle/secret-id

   Key                   Value
   ---                   -----
   secret_id             725d9076-5a5c-4921-98f7-7535c767386a
   secret_id_accessor    b780e4d6-a2f2-4e03-8843-3e6a88b56f09
   secret_id_num_uses    0
   secret_id_ttl         0s

Generate an API Token

9. Generate an API token for the AppRole, supplying the APPROLE_ID (e.g. e633701e-893e-460d-8012-ea2afedbcd87) and the APPROLE_SECRET_ID (e.g. 725d9076-5a5c-4921-98f7-7535c767386a) from the previous commands:

   bao write auth/approle/login \
     role_id="APPROLE_ID" \
     secret_id="APPROLE_SECRET_ID"

   For Example:

   bao write auth/approle/login \
     role_id=" e633701e-893e-460d-8012-ea2afedbcd87" \
     secret_id="725d9076-5a5c-4921-98f7-7535c767386a"

   Key                     Value
   ---                     -----
   token                   s.TuQBY39kkpEDOqKcKYbWvpmZ
   token_accessor          N1qSJiqOz6mXlpbmFVT2LOfS
   token_duration          768h
   token_renewable         true
   token_policies          ["api-keys-secrets-policy" "default"]
   identity_policies       []
   policies                ["api-keys-secrets-policy" "default"]
   token_meta_role_name    api-key-reader-approle

   The resulting AppRole token (e.g. s.TuQBY39kkpEDOqKcKYbWvpmZ) can be used by a user, machine, or service (e.g. a web application) to authenticate OpenBao API calls and read the LLM service API key secret.

Storing Secrets

Create the secret store defined in the policy created above.

1. Enable the KV secrets engine, replacing SECRET_MOUNT_PATH:

   bao secrets enable --path=SECRET_MOUNT_PATH kv

   For Example:

   bao secrets enable --path=api-keys kv

   Success! Enabled the kv secrets engine at: api-keys/

2. The example secret from Azure contains a single sensitive value. Store this value in the SECRET_MOUNT_PATH using a SECRET_KEY (e.g. key) and assign it a SECRET_NAME (e.g. llm-service):

   bao kv put --mount=SECRET_MOUNT_PATH SECRET_NAME \
     "SECRET_KEY"="SECRET_VALUE"

   For Example:

   bao kv put --mount=api-keys llm-service \
     "key"="0z7NUSJ6gHKoWLkO5q2%Zq1E1do%m&RSa47jljP4nMVs7qG#n87Lai46niZUCrLP"

   Success! Data written to: api-keys/llm-service

Retrieving Secrets

1. While authenticated with the root token, retrieve the secret using the OpenBao CLI (bao), replacing SECRET_MOUNT_PATH and SECRET_NAME:

   bao kv get --mount=SECRET_MOUNT_PATH SECRET_NAME

   For Example:

   bao kv get --mount=api-keys llm-service

   ====== Data ======
   Key       Value
   ---       -----
   key       0z7NUSJ6gHKoWLkO5q2%Zq1E1do%m&RSa47jljP4nMVs7qG#n87Lai46niZUCrLP

2. Test access using the APPROLE_TOKEN (e.g. s.36Yb3ijEOJbifprhdEiFtPhR) saved earlier, your SECRET_MOUNT_PATH, and the SECRET_NAME:

   curl --header "X-Vault-Token: APPROLE_TOKEN" \
        --request GET \
        $BAO_ADDR/v1/SECRET_MOUNT_PATH/SECRET_NAME \
        | jq

   For Example:

   curl --header "X-Vault-Token: s.36Yb3ijEOJbifprhdEiFtPhR" \
        --request GET \
        $BAO_ADDR/v1/api-keys/llm-service \
        | jq

   {
     "request_id": "4ea9a66e-c63a-433c-b2e2-015c39c45086",
     "lease_id": "",
     "renewable": false,
     "lease_duration": 2764800,
     "data": {
       "key": "0z7NUSJ6gHKoWLkO5q2%Zq1E1do%m&RSa47jljP4nMVs7qG#n87Lai46niZUCrLP"
     },
     "wrap_info": null,
     "warnings": null,
     "auth": null
   }

   The AppRole token can be used by applications or services to retrieve secrets through the OpenBao API.

   Note

   According to the OpenBao API documentation, OpenBao is API-compatible with HashiCorp Vault. This means most Vault client libraries should also work with OpenBao, including:

   • Go
   • Ruby
   • C#
   • Java
   • Kotlin
   • Node.js
   • PHP
   • Python

Production Considerations

When migrating workloads from Azure Key Vault across providers to OpenBao on Akamai Cloud, it’s important to ensure your deployment is secure, resilient, and optimized for performance. This section covers key security and high availability considerations to help you maintain a reliable and protected secrets management system.

Security

Security should be a top priority for a production-grade OpenBao deployment. Protecting secrets from unauthorized access, ensuring secure communication, and enforcing strict access controls are essential to maintaining a secure environment.

• Access Control Policies: Use OpenBao’s policy system to enforce RBAC. Define granular policies that grant only the necessary permissions, following the principle of least privilege.
• Audit Logging: Enable detailed audit logs to track all access and modifications to secrets. OpenBao supports multiple logging backends, such as syslog and file-based logs, to help monitor suspicious activity.
• Secrets Lifecycle Management: Implement automated secrets rotation, revocation, and expiration to ensure secrets do not become stale or overexposed. Consider using dynamic secrets where possible to generate time-limited credentials.
• Securing Network Communication: Configure OpenBao to use TLS to encrypt all communications, ensuring data in transit remains secure. Regularly rotate TLS certificates to prevent expiration-related outages and reduce the risk of compromised certificates.

High Availability

Production-grade OpenBao environments should be deployed with fault tolerance and scalability in mind. OpenBao’s Autopilot mode for high availability ensures that if the active node fails, the cluster automatically elects a new leader, maintaining uptime without manual intervention. However, to enable seamless failover, organizations must configure their deployment correctly, and proactively monitor system health.

• Raft Storage Backend: Use OpenBao’s integrated storage, based on the Raft protocol, to enable distributed data replication across multiple nodes. This ensures data consistency and fault tolerance while reducing reliance on external storage backends. Configure regular Raft snapshots for disaster recovery.
• Deploy Multiple Nodes: OpenBao recommends at least five nodes for a high-availability deployment. The active node handles all requests, while standby nodes remain ready to take over in case of failure.
• Monitor Leader Status: Use bao operator raft list-peers to check the cluster’s leader and node statuses. This command helps ensure that standby nodes are correctly registered and ready for failover.

More Information

You may wish to consult the following resources for additional information on this topic. While these are provided in the hope that they will be useful, please note that we cannot vouch for the accuracy or timeliness of externally hosted materials.

• Azure Key Vault Documentation
• Azure az CLI Documentation
• OpenBao Configuration Documentation
• OpenBao Integrated Storage
• OpenBao GitHub