HashiCorp Vault → OpenBao
What it saves, what actually moves, what you rebuild — and the thing that catches people.
What it costs, and what it saves
Neutral on licence cost if you already self-host Vault Community. Against HCP Vault — from about $450/month for a dev cluster and roughly $1,150 for production Essentials — OpenBao is the infrastructure only.
Moves cleanly
Effectively everything. OpenBao is a fork of the last MPL-2.0 Vault release, so the API, CLI, policies and storage format are Vault's. This is closer to a rename than a migration.
You rebuild
Very little. Terraform providers and existing tooling largely work; you change the binary and the endpoint.
What HashiCorp Vault costs you today
The community edition is free. HCP Vault Dedicated starts around $450/month for a development extra-small cluster; a production Essentials Small cluster is roughly $1,150/month before per-client fees near $72.92/month, and a standard small cluster with 50 clients runs about $5,000/month. Enterprise self-managed licences are negotiated and land well above that. Figures checked 2026-07-31 — note the most detailed public breakdowns are published by competitors, so verify against HashiCorp directly before you budget.
What actually holds you in
Lower than the operational effort implies, and this is the good news. Vault's HTTP API is well documented and OpenBao is a direct fork, so moving there is close to a drop-in — the paths, policies and tokens are the same shape. What actually holds you is the surrounding machinery: auto-unseal wired to a cloud KMS, dynamic database engines, PKI issuance, and the Terraform and Kubernetes integrations built around Vault's specific behaviour. Teams that use Vault as a key-value store move in an afternoon; teams using dynamic credentials and PKI have a project.
What you are moving to
OpenBao is the Linux Foundation's fork of Vault, taken from the last release before the Business Source License and continued under MPL-2.0. It is not a reimplementation or a lookalike: it is the same codebase, so the API, the CLI, the policy language and the storage format are Vault's, and migration is closer to a rename than a port. Governance is the whole point — it sits under a foundation with multiple corporate contributors rather than a single vendor who can change the terms again. Around 6.9k stars and actively developed. If your reason for looking is the licence rather than the product, this is the answer and there is not much more to decide.
Free and open source. You run it on your own infrastructure.
OpenBao strengths
- The same codebase — migration from Vault is close to drop-in
- MPL-2.0 under Linux Foundation governance, not a single vendor's discretion
- Keeps Vault's dynamic secrets, PKI and transit engines
- Existing Vault knowledge, tooling and Terraform providers transfer directly
What you give up
- Inherits Vault's operational difficulty in full — this is not the easy option
- Smaller community than Vault, and the ecosystem is still catching up
- No enterprise namespaces or vendor support contract
- Divergence from upstream Vault will grow over time
The migration, step by step
- 1Snapshot your Vault storage — this is the migration artifact and the rollback plan
- 2Stand up OpenBao pointed at a copy of that storage
- 3Verify auth methods, policies and secret engines respond identically
- 4Repoint applications one namespace at a time
- 5Keep the Vault binary available until a full unseal cycle has been proven on OpenBao
The gotcha
Auto-unseal configuration is the piece that does not simply carry over — cloud KMS bindings need re-establishing, and discovering that during an unplanned restart is the worst possible time.
When to stay on HashiCorp Vault
You use Vault Enterprise namespaces, or you have a support contract you actually call.
Other ways off HashiCorp Vault
More Layer 3 migrations
Figures verified 2026-07-31 against vendor pricing pages. Prices change and migrations differ by estate — treat the cost delta as a starting model, not a quote. Rankings and recommendations here are merit-only; affiliate income never changes a verdict. See our methodology.