A restored copy tells you what will move before production is touched

Overview

This is a typical engagement for a security platform team that runs a three-node HashiCorp Vault cluster on Raft storage for several application teams. The licence change of August 2023 and the 2025 acquisition have made "should we move to OpenBao" a standing question, and nobody can say what a move would involve. AceMQ and a partner secrets-management specialist produce the technical answer. The licence question stays with the customer's counsel.

Environment

A three-node Vault cluster on Raft in Kubernetes, auto-unseal through a cloud key service, a mix of key-value, database and PKI secrets engines, several auth methods, two audit devices, and applications that read secrets through the agent injector and direct API calls.

Approach

AceMQ lists every mount, auth method and plugin and marks what OpenBao provides, what needs a replacement and what the team uses from Enterprise. A Raft snapshot is restored into an isolated cluster, migrated there following OpenBao's documented order, and exercised with replayed application calls. The assessment ends in a verdict per mount and a cut-over plan, or a recommendation to stay.

Solution

1. 01Inventory of secrets engines, auth methods, external plugins, policies, audit devices and token use
2. 02Per-mount verdict: moves as is, needs a replacement, or blocks the move
3. 03Snapshot restored into an isolated cluster and migrated there, with application calls replayed against it
4. 04Check of client assumptions: token format, audit logging, agent injector and retry behavior at start-up
5. 05Review of the unseal path and a test of a leader loss and a restore
6. 06Cut-over plan: followers first, leader last, old storage kept for rollback

Technologies

HashiCorp VaultOpenBaoKubernetes