In 2023 HashiCorp relicensed its core products — including Vault — from an open-source licence to the Business Source Licence (BSL). Vault did not stop working, but it stopped being open source in the sense that matters for sovereignty: it is now source-available under terms controlled by a single (foreign) vendor.
Why this matters for sovereign environments
Secrets — credentials, keys, tokens — are the most sensitive configuration you hold. Two properties are non-negotiable for a sovereign posture:
- You can audit it. Source-available under restrictive terms is weaker than truly open source you can freely inspect, rebuild, and fork.
- You control it. A managed or foreign-jurisdiction vault means your most sensitive material sits under someone else’s control plane.
The relicense turned a quiet assumption (“our secrets engine is open”) into an explicit dependency to reconsider.
The open-source path
The community responded, and a clean sovereign stack now exists:
- OpenBao — the open-source fork of Vault, self-hostable, under open governance.
- External Secrets Operator (ESO) — delivers and rotates secrets into Kubernetes workloads through native mechanisms, without rewriting the applications that consume them.
Together they give you self-hosted secrets management with automated rotation and no foreign vault dependency — the foundation of a zero-trust posture.
What good looks like
- Secrets live in a store you run, inside your boundary (including air-gapped).
- Rotation is automated; a leaked credential has a short useful life.
- Access is least-privilege and short-lived (zero-trust, not perimeter trust).
- The whole stack is open source you can evidence to an auditor.
See Secrets & Zero-Trust for how the platform assembles this, and open source as strategic autonomy for why the licence itself is a sovereignty question.