Per T1938, I'd like to propose to supersede Vault by OpenBao.

Plan would be:

• deploy OpenBao on Complector
• export the Vault secrets from ops/ and apps/ kv2 store with Medusa
• import the kv2 secrets to OpenBao with Medusa
• recreate PKI

Open questions:

• do we need the web UI? Lot of deployments run without, OpenBao 2.0.1 doesn't ship with (*)
  • if so, do we try to build it with <code>make dev-ui</code>?
• common security practice is the private key of a PKI can't leave a CA
  • procedure to create the PKI is fully documented in Agora
  • that would call to recreate the PKI, and redeploy roles/core/certificates everywhere (easy as already automated in Salt)
• keys shares

(*) The main reason is UI exposes both enterprise and open source features, so it's a mess while OpenBao team is trying to remove the codepath to the enterprise features.