Skip to main content

OpenBao proxy persistent caching

OpenBao Proxy can restore tokens and leases from a persistent cache file created by a previous OpenBao Proxy process. The persistent cache is a BoltDB file that includes tuples encrypted by a generated encryption key. The encrypted tuples include the OpenBao token used to retrieve secrets, leases for tokens/secrets, and secret values.

info

Note: OpenBao Proxy Persistent Caching will only restore leased secrets. Secrets that are not renewable, such as KV v2, will not be persisted.

In order to use OpenBao Proxy persistent cache, auto-auth must be used. If the auto-auth token has expired by the time the cache is restored, the cache will be invalidated and secrets will need to be re-fetched from OpenBao.

info

Note OpenBao Proxy persistent cache is currently supported only in a Kubernetes environment.

OpenBao proxy persistent cache types​

Please see the sidebar for available types and their usage/configuration.

Persistent cache example configuration​

Here is an example of a persistent cache configuration.

# Other OpenBao proxy configuration blocks
# ...

cache {
  persist "kubernetes" {
    path = "/openbao/proxy-cache"
  }
}