Dynamic OpenStack Credentials with Vault and OpenBao

Eliminate static API keys and credential sprawl with our open-source Vault and OpenBao plugin that generates short-lived OpenStack application credentials on demand—now with multi-project support.

Today we're releasing major updates to our OpenStack Secrets Engine. The plugin now works with both HashiCorp Vault and OpenBao.

Why ephemeral credentials matter

Static API keys are a liability. They end up scattered across config files, CI/CD pipelines, and environment variables. When credentials don't expire, neither does your exposure window.

Our secrets engine flips this model. Applications request credentials when they need them, use them immediately, and watch them expire minutes later.

No rotation schedules. No keys to track. No emergency revocations after incidents.

What's new

Multi-project support. This was our most requested feature. You can now define project-scoped rolesets that generate credentials for specific OpenStack projects—each with precisely the roles needed.
Modernized codebase. We've rebuilt on Gophercloud v2 and Go 1.25. Configuration now uses OpenStack-native naming—parameters like user_domain_id and project_domain_name match standard tooling.

Compliance gets simpler

Dynamic credentials change the audit conversation. Instead of explaining rotation policies and access reviews, you demonstrate that credentials physically cannot be long-lived.

Every request is authenticated, authorized, and logged. This aligns with zero-trust principles that SOC 2, ISO 27001, and PCI DSS frameworks increasingly expect.

Open source

The plugin is Apache 2.0 licensed. We built it because we needed it—we run it in production on VEXXHOST infrastructure.

Installation takes minutes. See the README for details.

Why ephemeral credentials matter

Static API keys are a liability. They end up scattered across config files, CI/CD pipelines, and environment variables. When credentials don't expire, neither does your exposure window.

Our secrets engine flips this model. Applications request credentials when they need them, use them immediately, and watch them expire minutes later.

No rotation schedules. No keys to track. No emergency revocations after incidents.

What's new

Multi-project support. This was our most requested feature. You can now define project-scoped rolesets that generate credentials for specific OpenStack projects—each with precisely the roles needed.

Modernized codebase. We've rebuilt on Gophercloud v2 and Go 1.25. Configuration now uses OpenStack-native naming—parameters like user_domain_id and project_domain_name match standard tooling.

Compliance gets simpler

Dynamic credentials change the audit conversation. Instead of explaining rotation policies and access reviews, you demonstrate that credentials physically cannot be long-lived.

Every request is authenticated, authorized, and logged. This aligns with zero-trust principles that SOC 2, ISO 27001, and PCI DSS frameworks increasingly expect.

Dynamic OpenStack Credentials with Vault and OpenBao

Why ephemeral credentials matter

What's new

Compliance gets simpler

Open source

Virtual machines, Kubernetes & Bare Metal Infrastructure

What production is teaching us.

The Infrastructure Decisions That Are Hardest to Undo

GPU Infrastructure Upgrades: CUDA, Drivers & Kubernetes

Your Cloud Bill Isn't the Same as Your Cloud Cost

Dynamic OpenStack Credentials with Vault and OpenBao

Why ephemeral credentials matter

What's new

Compliance gets simpler

Open source

Virtual machines, Kubernetes & Bare Metal Infrastructure