bao-vault

Seeds OpenBao secrets and configures agent AppRoles from .yaml files.

4|1|Updated Jan 16, 2026

Search Tags:#automation #infrastructure #vault #seeding #credential #openbao

Ready to run

npx skills add https://github.com/jankneumann/agentic-coding-tools --skill bao-vault

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: bao-vault
Source: https://github.com/jankneumann/agentic-coding-tools/tree/main/.agents/skills/bao-vault
Command: npx skills add https://github.com/jankneumann/agentic-coding-tools --skill bao-vault

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, hvac, and includes scripts (resource) components.

What problem does it solve?

Manual provisioning of OpenBao/Vault secrets and agent credentials is error‑prone and time‑consuming, preventing reliable infrastructure automation.

Core Features & Use Cases

Secret Seeding: Loads key/value pairs from the project's .secrets.yaml into Vault.
AppRole Creation: Generates AppRoles for HTTP‑transport agents based on agents.yaml.
Database Engine Configuration (optional): Sets up a PostgreSQL secrets engine for dynamic credentials.
Use Case: When deploying a new coordinator environment, run this skill to bootstrap all required Vault entries in a single step.

Quick Start

Run the bao-vault skill to seed OpenBao with the project's secrets and configure agent credentials.

Frequently Asked Questions about bao-vault

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate OpenBao vault seeding and credential setup during infrastructure provisioning?▼

Automate OpenBao vault seeding by loading key/value pairs from a .secrets.yaml file and configuring agent AppRoles from an agents.yaml file. This eliminates manual provisioning errors and bootstraps all required Vault entries in a single step during infrastructure deployment.

What do I need to configure OpenBao secrets and agent AppRoles programmatically?▼

You need the BAO_ADDR and BAO_TOKEN environment variables configured, along with the hvac and PyYAML Python libraries installed. Provide a .secrets.yaml file for key/value pairs and an agents.yaml file to generate AppRoles for HTTP-transport agents.

Can I set up a PostgreSQL database secrets engine when seeding OpenBao?▼

Yes, you can optionally configure a PostgreSQL database secrets engine for dynamic credentials when seeding OpenBao. This setup occurs alongside loading static key/value secrets and generating agent AppRoles during the infrastructure provisioning workflow.

What is the best way to bootstrap a new OpenBao coordinator environment with secrets?▼

Bootstrap a new OpenBao coordinator environment by running an automated seeding process that loads .secrets.yaml into Vault and configures HTTP agent AppRoles from agents.yaml. This single-step approach ensures reliable, repeatable infrastructure automation without manual data entry.

Does the hvac Python library work with OpenBao for vault automation?▼

Yes, the hvac Python library works with OpenBao for vault automation and is a required dependency. Combined with PyYAML, it enables the programmatic loading of YAML secret files and the configuration of AppRoles and database engines.

Why does manual OpenBao vault provisioning fail during infrastructure automation?▼

Manual OpenBao vault provisioning fails during infrastructure automation because it is error-prone and time-consuming. Automating the process by loading .secrets.yaml and agents.yaml ensures reliable, repeatable credential setup and secret seeding without human intervention.