Infinito.Nexus 14.2 introduces OpenBao for secrets management, giving applications and services a dedicated way to handle credentials, API keys and machine identities.

OpenBao integrates with the existing Infinito.Nexus identity and deployment model. Users can authenticate through Keycloak, or LDAP when OpenLDAP is deployed, while services and automation use their own AppRole identities. Credentials are automatically changed on every deployment, and the OpenBao root token is not retained after the initial setup.

The release also adds recovery handling, automatic unsealing after restarts, optional internal PKI and Prometheus alerts when OpenBao is sealed or unreachable.

In addition, 14.2 fixes LDAP administration in LAM, improves Docker Swarm handling of existing networks, adds role-local Prometheus alert rules, restores video recording for manually created Playwright contexts and updates pgAdmin to 9.18.

OpenBao Arrives

Applications increasingly depend on credentials: database passwords, API keys, service accounts and other secrets.

With Infinito.Nexus 14.2, OpenBao becomes available as a platform role for handling these secrets.

The new web-app-openbao role deploys OpenBao and stores application credentials, API keys and machine identities. Human access follows the existing identity infrastructure through Keycloak or LDAP, while services receive dedicated AppRole identities.

This makes service credentials easier to separate and manage.

A service does not need to use the OpenBao root token. Instead, it receives its own identity, and its credentials are changed whenever the deployment runs.

That matters particularly for automated infrastructure: credentials no longer need to remain unchanged simply because a service continues running.

Built for Automated Deployments

OpenBao is integrated into the deployment lifecycle rather than being treated as a manually maintained service.

After the initial deployment, the root token is not kept. If service credentials are lost, a recovery key stored in the token store allows a later deployment to regain access and provision them again.

OpenBao can also automatically unseal itself after a restart.

The seal key is stored only in the encrypted inventory. This means the encrypted inventory and the OpenBao volume belong together when creating backups; the volume alone is not sufficient for recovery.

For deployments that need it, an internal PKI can also be enabled.

Know When Secrets Infrastructure Is Down

Secrets infrastructure needs monitoring just like any other critical service.

Infinito.Nexus 14.2 adds Prometheus alerting for OpenBao, including detection of a sealed or unreachable node.

The release also introduces role-local Prometheus alert rules. A role can now provide the rules for the metrics it owns, while Prometheus only loads them when that role is actually being monitored.

This keeps monitoring configuration close to the service it belongs to.

Other Improvements

14.2 also includes several smaller fixes across the platform.

LDAP import, export and Multi edit operations in LAM work correctly again after a Content Security Policy issue prevented their background-job checks from running.

Docker Swarm deployments can now reuse networks that already exist instead of failing because the network name is already present. This is particularly useful for networks created by infrastructure such as Prometheus before an application’s own stack is deployed.

For developers, manually created Playwright browser contexts now inherit the configured video-recording settings, providing video artifacts alongside traces when tests fail.

pgAdmin is also updated from 9.17 to 9.18.

A Safer Place for Application Credentials

Infinito.Nexus 14.2 is a smaller release, but OpenBao adds an important capability to the platform.

Applications and automation need credentials. With OpenBao, those credentials can have their own identities, lifecycle and recovery mechanism instead of being treated as permanent deployment values.

Secrets become part of the infrastructure — with rotation, recovery, authentication and monitoring built into the deployment.

Read the complete Infinito.Nexus 14.2.0 changelog for the full technical details.