OpenBao is gaining enterprise credibility as NVIDIA, Broadcom, SAP and GitLab adopt or support the open-source secrets-management platform, strengthening its case as an alternative to proprietary infrastructure.
OpenBao is moving from an open-source fork of HashiCorp Vault to enterprise security infrastructure backed by major technology companies, including NVIDIA, Broadcom, SAP and GitLab. The project is stewarded by the Open Source Security Foundation (OpenSSF).
GitLab 19.0 uses OpenBao as the engine behind its native secrets manager, while Broadcom has integrated it into vSphere Supervisor as part of VMware Cloud Foundation (VCF) 9.0. NVIDIA’s adoption adds further enterprise weight, alongside its broader open-source activity, including the full open-sourcing of its NVIDIA Cloud Functions (NVCF) platform.
Secrets management protects passwords, encryption keys, certificates and access tokens used by applications, systems and machines. Its importance is increasing as cloud-native and AI environments become more distributed and automated.
“Secrets management is now a core part of cyber resilience. Modern systems rely on it to connect applications, services and infrastructure. As cloud and AI environments become more complex, organisations need better visibility and control over how those secrets are created, stored, rotated and accessed,” said Rob Kenefeck, Field CTO at ControlPlane and Australian OpenSSF ambassador.
Alex Scheel, Head of OpenBao Development at ControlPlane, said, “When major technology providers begin building around open source infrastructure, it gives the wider market confidence that these platforms are mature, credible and ready for serious operational environments.”
Scheel, chair of the OpenBao Development Working Group and former OpenBao Technical Steering Committee chair, recently joined ControlPlane, which also offers enterprise support for OpenBao covering migration, architecture, integration and technical support.
The growing adoption points to stronger demand for open-source alternatives to critical security infrastructure, particularly as enterprises manage expanding machine and agent identities.
