Learn Secret Management - Pre-Requisites Skills & Environment Setup

#Introduction

Welcome to the Learn Secret Management with OpenBao series! This series will take you from mastering OpenBao — the community-maintained open-source fork of HashiCorp Vault under the Linux Foundation — from the fundamentals of secret management to production-grade architecture. There are 21 episodes in total that build your understanding layer by layer: environment setup, architecture and unsealing, the KV secrets engine, dynamic database credentials, transit encryption, PKI, policies, authentication, and all the way through Kubernetes, CI/CD, and high availability integrations.

But before writing your first secret, there are several foundational skills and tools you need to prepare. Why do these pre-requisites matter? Because OpenBao is not just a command you type — it is a cryptographic service that runs on a server, speaks over a REST API, and depends on a correct understanding of keys, encryption, and tokens. If the foundation is not in place, errors like permission denied or token expired will feel like an endless puzzle.

Episode 0 is your roadmap: we prepare the foundational skills, gather the tools, and then run your first OpenBao server, which you will use throughout the series.

#What is Secret Management

Secret management is the discipline of managing sensitive information — passwords, API keys, tokens, and certificates — centrally, securely, and with strict access control. Without secret management, credentials usually pile up in configuration files, hardcoded environment variables, or team chat groups — the three places most likely to leak.

OpenBao solves this problem by providing a single central point where secrets are stored encrypted, accessed via API, and governed by policies. Throughout this series you will see how OpenBao manages static secrets in the KV engine, creates dynamic credentials for databases, encrypts data with the transit engine, and issues TLS certificates with the PKI engine.

#Required Foundational Skills

#Cryptography: Symmetric, Asymmetric, and Hashing

OpenBao is built on cryptography, so you should at least understand these three concepts:

The most important point: secret data in OpenBao is never stored in plaintext. Before being written to storage, data is always wrapped in an encryption layer by the barrier. This is the concept you will dive into in episode 2.

#REST API and JSON

Every interaction with OpenBao, including the bao CLI commands, is actually an HTTP call to the REST API. Each command maps to an endpoint such as /v1/secret/data/app, and data is sent and received in JSON format. You do not need to be an API master to follow this series, but you should understand that:

• HTTP methods (GET, PUT, POST, DELETE, LIST) determine the operation.
• JSON responses contain the requested data, metadata, and lease.
• Token is sent via the X-Vault-Token header for authorization.

#Linux CLI Proficiency

Nearly all interaction with OpenBao happens through the terminal. At minimum, you should be comfortable with directory navigation (pwd, ls, cd), reading manuals (man), and running commands with sudo. The bao CLI is the primary workhorse of this series — there are no clickable buttons for most operations.

#Software & Tools to Prepare

Here is the list of software you will use throughout the series:

#Installing the OpenBao CLI (bao)

#Installing on Linux with apt/dnf

Debian/Ubuntu-based distributions can use the apt package manager, and Fedora/RHEL-based distributions can use dnf:

sudo apt update && sudo apt install openbao -y
sudo dnf install openbao -y
bao version

Once installed, run bao version to confirm the binary is available. This series uses OpenBao 2.x, and every command used is compatible with that version.

#Standalone Binary

If your distribution does not yet have a package, download the standalone binary from the official release page, then extract it and move it to your PATH:

wget https://github.com/openbao/openbao/releases/latest/download/openbao_2.x_linux_amd64.zip
unzip openbao_2.x_linux_amd64.zip
sudo mv bao /usr/local/bin/
bao version

#Installing on macOS

For macOS users, Homebrew provides an official formula:

brew install openbao
bao version

Whatever installation path you choose, the end goal is the same: the bao command is available in your terminal.

#Running the OpenBao Server

Once the CLI is installed, you need a server. There are two modes you will use throughout the series.

#Dev Mode

Dev mode is the fastest way to start practicing. The server starts right away with in-memory storage, is already unsealed, and immediately returns a root token in its output:

bao server -dev

Pay attention to the terminal output: you will see the Unseal Key and Root Token printed to the screen. This token will be used as your BAO_TOKEN. Dev mode is convenient for learning, but never use it in production — all data is lost when the process stops.

#Production Server with Docker

To simulate a production environment, use the official openbao/openbao:latest image:

services:
  openbao:
    image: openbao/openbao:latest
    command: ["server", "-dev"]
    container_name: openbao
    environment:
      - BAO_DEV_ROOT_TOKEN_ID=root
      - BAO_ADDR=http://127.0.0.1:8200
    ports:
      - "8200:8200"
    cap_add:
      - IPC_LOCK

#CLI Environment Configuration

The bao CLI needs two main environment variables to talk to the server: the server address and a token. Set them in every terminal session for practice:

export BAO_ADDR="http://127.0.0.1:8200"
export BAO_TOKEN="s.your-root-token-here"
bao status

BAO_ADDR tells the CLI where to send requests; BAO_TOKEN is your identity for authorization. For extra convenience, write both variables into ~/.bashrc or ~/.zshrc so they are populated automatically every time you open a new terminal.

#Accessing the OpenBao Web UI

OpenBao provides a web interface for viewing and managing secrets visually. Once the server is running, open your browser and navigate to http://127.0.0.1:8200/ui:

• Enter the root token you saved as BAO_TOKEN.
• Explore the lists of secrets engines, policies, and audit devices.
• See how the KV store, dynamic credentials, and tokens work visually.

The Web UI is not a replacement for the CLI — many advanced operations are still easier via the terminal — but the UI is very helpful for quickly verifying the results of your practice.

#Verifying Your Environment

Before moving on to the next episode, make sure the entire environment is healthy:

bao version
bao status
bao secrets list
echo $BAO_ADDR

bao status will show details such as Sealed, HA Enabled, and the server version. If all of the commands above run without errors, your environment is ready for the entire series.

#Conclusion

In episode 0 you prepared the foundation for the entire series: understanding the foundational skills in cryptography, REST API, JSON, and the Linux CLI that underpin OpenBao; gathering the tools you need such as the bao CLI and the server; and configuring the BAO_ADDR and BAO_TOKEN environment with dev mode and Docker.

Key takeaways:

• Secret management is a necessity, not a choice — credentials scattered in configuration files are the biggest risk.
• Master the three cryptography concepts — symmetric, asymmetric, and hashing — because OpenBao is built on them.
• The bao CLI is your primary tool — make sure it is installed and bao status runs without errors.
• Every practice session needs BAO_ADDR and BAO_TOKEN — always have them ready before you begin.

In the next episode, episode 1, we will discuss the history of the OpenBao fork from HashiCorp Vault and the Linux Foundation manifesto — from the license change that triggered the split in December 2023, the commitment to being 100 percent open source under the MPL-2.0 license, to why DevOps teams around the world are flocking to OpenBao as a modern secret management tool. Make sure bao status is green, because the Secret Management journey is just beginning!