Blog

HashiCorp Vault and OpenBao: KV, Auth Methods, Policies and Dynamic Credentials for SQL Server

Vault and OpenBao create a new, short-lived database user on every startup, and the best way to keep the app unaware of Vault is to read the file Vault Agent writes with reloadOnChange. We set up KV v2, policies and AppRole and see with real output on SQL Server lease renewal, a stored connection string failing with "Login failed" after revoke, a revoke stuck without KILL permission, and OpenBao lacking a SQL Server plugin.