OpenBao Vault Migration check — check vault files for openbao

17 findings in a 31-line HashiCorp Vault deploy script: that is what a line-by-line OpenBao migration check reports for the platform, SRE and DevOps engineers who own self-managed Vault and now have to move it to OpenBao.

Migrate from HashiCorp Vault to OpenBao: what changed and when

The Vault LICENSE file names "Vault Version 1.15.0 or later" as the Licensed Work under the Business Source License, with IBM as licensor. Vault 1.14.x was the last line before that, and OpenBao, the fork, publishes an in-place migration guide tested from Vault 1.14.1 only. Then, on September 23, 2026, OpenBao 2.7.0 shipped and moved more pieces out of the binary: the pkcs11, alicloudkms, awskms, azurekeyvault, gcpckms and ocikms seals became external plugins, the Kerberos, LDAP and RADIUS auth methods and the LDAP secrets engine left the main distribution, and the file storage backend was removed.

So a migration plan written in the spring is already out of date. The config that unsealed with awskms on OpenBao 2.6 needs a plugin installed before it starts on 2.7.0.

The sample script

Our sample is a normal bootstrap script: it exports VAULT_ADDR, writes a server config through a heredoc, pulls hashicorp/vault:1.17.2, installs the HashiCorp Helm chart, logs in, enables aws auth, configures an mssql database connection and rejects any token that does not start with hvs.

Run through the 14 rules, it gives 7 errors, 9 warnings and 1 info:

• seal "awskms": no longer built in since 2.7.0. Fix: install the awskms seal plugin from openbao-plugins.
• storage "consul": the OpenBao 2.7.0 server registers raft, postgresql, pebbledb and inmem only. Fix: move to raft with bao operator migrate.
• hashicorp/vault:1.17.2: BSL, and newer than the 1.14.1 the guide was tested from. Fix: quay.io/openbao/openbao on a fresh cluster.
• vault auth enable aws: the OpenBao plugin registry builds in approle, cert, jwt, kubernetes, oidc and userpass. The guide says a mount without its plugin is skipped at startup and serves no paths.
• plugin_name=mssql-database-plugin: built-in database plugins are mysql, cassandra, influxdb, postgresql, redis and valkey.
• the hvs. check: OpenBao issues new tokens as s.<random>, so the script would reject every token issued after the swap.

The warnings are the quiet ones: VAULT_ADDR and VAULT_TOKEN (OpenBao's api/client.go reads BAO_ADDR and BAO_TOKEN), four calls to the vault binary (the command is bao) and two Enterprise licence settings. The info is disable_mlock, which OpenBao has not used since 2.0.0.

Why grep and chatbots miss it

A grep for vault matches every path, comment and bucket name, and says nothing about which seal names are now plugins. A chatbot trained before September 23, 2026 still describes awskms as built in. The facts sit in three places that change every release: the CHANGELOG, internal/helper/builtinplugins/registry.go and internal/command/commands.go. The linter carries those lists and shows the exact line.

Try it on your own files

Open the free web version, paste a script, Terraform module, Helm values file or server HCL and press Check. The same engine runs in the VS Code extension on the open file, with every finding free. The OpenBao version of the sample script gives 0 findings, so a clean result means clean. The full version scans a whole workspace and writes one migration report for the change ticket.