This article explains how to deploy OpenBao, the Linux Foundation's open-source fork of HashiCorp Vault, on Kubernetes using CloudNativePG as a PostgreSQL backend for secrets management. The setup provides an entirely open-source infrastructure with passwordless mTLS authentication, self-healing capabilities, and no vendor lock-in, using the cnpg-playground for local testing.
Infisical implemented folder-based access control to handle permission edge cases beyond standard RBAC, replacing a more complex Additional Privileges system. The feature allows granting or denying access to specific folders without changing user roles, addressing scenarios where role-based permissions alone don't fit organizational needs.