• about the UI it could be usefull managing secrets more easyly

• certificate gen seem good for me

• key share => is it possible to generate a token like with salt now ?

Yes, it's a fork from Vault 1.14 so we've all the features of token generation. back to the shorter s. tokens).

When starting Vault, we need to unseal it or setup auto-unseal. For the manual unseal, Vault uses Shamir algorithm to divide a secret into N keys parts, where M are needed to unseal the vault.

So, there is a new reason to do the upgrade.

We're considering adopting Terraform/OpenTofu to provision things actively maintained there, less on Salt:

• VMware ESXi
• Vault provisioning - Salt has out of the box support for policies, everything else we need to code it

Terraform needs to maintain an internal state to be able to detect changes, ie Terraform doesn't play the idempotent game to analyze resources, it memorizes instead what has been previously deployed.

With OpenTofu, this state can be encrypted using OpenBao encryption-as-a-service. The last supported version is 1.14 for Vault, after that, they only support OpenBao. Currently, both are API compatible, but in the future, that could change.

Also the UI is now directly shipped with bao, without any need for a build flag anymore.

@DorianWinty could you run on your machine dnf install openbao ; bao server -dev? You'll be able to check if the UI is OK. It seems the same than Vault for me.