You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 10 Current »

Using binary

This section describes the standard procedure for installing the OpenBao command‑line interface (CLI) using binary file. The installation uses the official packages provided in the OpenBao release artifacts.
 

1. Downloading the OpenBao Package (Ubuntu & Rocky Linux)

The OpenBao CLI is distributed as platform‑specific packages through the official GitHub release artifacts. This section describes how to download the correct package for Ubuntu (DEB) and Rocky Linux (RPM).


Ubuntu (DEB package)Rocky Linux (RPM package)

Ubuntu uses .deb packages. Download the latest OpenBao release for amd64:

curl -LO https://github.com/openbao/openbao/releases/latest/download/openbao_<version>_linux_amd64.deb

Replace <version> with the desired release (e.g., 2.6.2).

Verify the checksum (optional):

sha256sum openbao_<version>_linux_amd64.deb

Install:

sudo apt install ./openbao_<version>_linux_amd64.deb


Rocky Linux uses .rpm packages. Download the latest OpenBao release for amd64:

curl -LO https://github.com/openbao/openbao/releases/latest/download/openbao_<version>_linux_amd64.rpm

Verify the checksum (optional):

sha256sum openbao_<version>_linux_amd64.rpm

Install:

sudo dnf install -y openbao_<version>_linux_amd64.rpm

 


2. Verify the installation

Confirm that the CLI is available:

bao --version

3. Configure the OpenBao endpoint

Set the address of the EWC Secret Manager instance:
Codice
 

export BAO_ADDR="https://secrets.europeanweather.cloud"

This environment variable ensures that all CLI commands target the correct endpoint.
 

4. Authenticate

using token

using OIDC

You login using EWC IAM: EWC Secret Manager - Accessing the system. Once you are in, you can simply copy the token from the top left corner profile button:

Pre-requisite:

OIDC authentication requires the OpenBao CLI to start a local callback listener on port 8250. This listener receives the authentication token after you complete the login in your browser. Before running the login command, ensure the following conditions are met:

Local callback listener (port 8250)

The CLI opens a temporary local HTTP server on:

http://localhost:8250

This server must be reachable by the browser you use to complete the login.

Port availability

Port 8250 must be free on the machine where the CLI is running. If another process is already using this port, the OIDC login will fail.

You can verify port availability with: 

ss -tln | grep 8250

Start the login flow

bao login -method=oidc

A browser window will open where you can authenticate using your EWC IAM tenancy credentials. If doesn't open on some Operating System, you can copy the URL provided and paste it in the browser.

Browser reachability

The browser used for authentication must be able to reach the machine running the CLI on localhost:8250. This means:

  • If you run the CLI on your local workstation, the browser works normally.

  • If you run the CLI on a remote server, the browser on your workstation cannot reach localhost:8250 on that server. In this case, you must copy the login URL and open it manually on a machine that can complete the flow.


5. Test basic CLI operations

Example commands:

Read a secret:

bao kv get kv/data/example

List secrets:

bao kv list kv/data/


  • No labels