### Typical Plugin Initialization Workflow

Source: https://openbao.org/docs/commands/plugin/init

This example outlines the typical workflow for initializing, starting, registering, and enabling plugins.

```bash
# 1. Download plugins

$ bao plugin init -config=openbao.hcl

  
# 2. Start OpenBao server  

$ bao server -config=openbao.hcl &

  
# 3. Register downloaded plugins  

$ bao plugin register -sha256=abc123... secret secrets-aws

  
# 4. Enable plugins  

$ bao secrets enable -path=aws secrets-aws
```

--------------------------------

### API Help for sys/mounts Path

Source: https://openbao.org/docs/commands

Example output of 'path-help' for the 'sys/mounts/' path, detailing supported operations like GET, POST, and DELETE.

```bash
$ bao path-help sys/mounts
```

```markdown
Request:        mounts
Matching Route: ^mounts$

  
List the currently mounted backends.  
  
## DESCRIPTION  

This path responds to the following HTTP methods.  

    GET /
        Lists all the mounted secret backends.  

    GET /<mount point>  
        Get information about the mount at the specified path.  

    POST /<mount point>  
        Mount a new secret backend to the mount point in the URL.  

    POST /<mount point>/tune  
        Tune configuration parameters for the given mount point.  

    DELETE /<mount point>  
        Unmount the specified mount point.  

```

--------------------------------

### Verify Kerberos Login Command

Source: https://openbao.org/docs/auth/kerberos

This is an example command to verify your Kerberos login setup. Ensure all parameters match your environment.

```bash
$ bao login -method=kerberos \
    username=my-name \
    service=HTTP/my-service \
    realm=EXAMPLE.COM \
    keytab_path=/etc/krb5/krb5.keytab  \
    krb5conf_path=/etc/krb5.conf  
```

--------------------------------

### Start OpenBao Server with Configuration File

Source: https://openbao.org/docs/commands/server

Starts an OpenBao server using a specified configuration file. Ensure the configuration file path is correct.

```bash
$ bao server -config=/etc/openbao/config.hcl  
```

--------------------------------

### Start OpenBao Agent with Configuration File

Source: https://openbao.org/docs/agent-and-proxy/agent

Use this command to start the OpenBao Agent, specifying the path to its configuration file.

```bash
$ bao agent -config=/etc/openbao/agent-config.hcl  
```

--------------------------------

### API Help Example (sys/mounts/)

Source: https://openbao.org/docs/commands

Example of API help output for the 'sys/mounts/' path, detailing available HTTP methods and operations.

```APIDOC
Request:	mounts
Matching Route:	^mounts$

List the currently mounted backends.

## DESCRIPTION

This path responds to the following HTTP methods.

    GET /
        Lists all the mounted secret backends.

    GET /<mount point>
        Get information about the mount at the specified path.

    POST /<mount point>
        Mount a new secret backend to the mount point in the URL.

    POST /<mount point>/tune
        Tune configuration parameters for the given mount point.

    DELETE /<mount point>
        Unmount the specified mount point.
```

--------------------------------

### Get Help for OpenBao Proxy Command

Source: https://openbao.org/docs/agent-and-proxy/proxy

Run the `bao proxy -h` command to display help information and available options for starting the OpenBao Proxy.

```bash
$ bao proxy -h  
```

--------------------------------

### Create Token with Specific Policies and TTL

Source: https://openbao.org/docs/commands/write

This example demonstrates creating a token with specific policies, a time-to-live (TTL), and a usage limit. API parameters are set after the path, and command options start with a hyphen.

```bash
$ bao write auth/token/create policies="admin" policies="secops" ttl=8h num_uses=3
```

--------------------------------

### Get Help for a Specific Command

Source: https://openbao.org/docs/commands

Example of getting help for a specific OpenBao CLI command, such as 'kv'.

```bash
$ bao kv help
```

--------------------------------

### Enable EPEL and Install OpenBao on RHEL/Fedora

Source: https://openbao.org/docs/install

Enable the EPEL repository and then install OpenBao on RHEL or Fedora systems using dnf.

```bash
$ dnf install -y epel-release
```

```bash
$ dnf install -y openbao
```

--------------------------------

### `azurekeyvault` Configuration Example

Source: https://openbao.org/docs/configuration/seal/azurekeyvault

This example shows configuring Azure Key Vault seal through the OpenBao configuration file by providing all the required values.

```hcl
seal "azurekeyvault" {
  tenant_id      = "46646709-b63e-4747-be42-516edeaf1e14"
  client_id      = "03dc33fc-16d9-4b77-8152-3ec568f8af6e"
  client_secret  = "DUJDS3..."
  vault_name     = "hc-openbao"
  key_name       = "openbao_key"
}

```

--------------------------------

### Start OpenBao Agent service using sc.exe

Source: https://openbao.org/docs/agent-and-proxy/agent/winsvc

Start the registered OpenBao Agent service using the `sc.exe start` command. The output will show the service type, state, PID, and other details.

```powershell
PS C:\Windows\system32> sc.exe start OpenBaoAgent  

  

SERVICE_NAME: OpenBaoAgent  
     TYPE               : 10  WIN32_OWN_PROCESS  
     STATE              : 4  RUNNING  
                             (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)  
     WIN32_EXIT_CODE    : 0  (0x0)  
     SERVICE_EXIT_CODE  : 0  (0x0)  
     CHECKPOINT         : 0x0  
     WAIT_HINT          : 0x0  
     PID                : 6548  
     FLAGS              :  

```

--------------------------------

### Start OpenBao Debug with Defaults

Source: https://openbao.org/docs/commands/debug

Initiates the debug command with sensible default settings. This is the simplest way to start gathering information about the OpenBao server.

```bash
$ bao debug

```

--------------------------------

### Install OpenBao with FreeBSD pkg

Source: https://openbao.org/docs/install

Install OpenBao on FreeBSD systems using the pkg package manager.

```bash
$ pkg install openbao
```

--------------------------------

### Configure Template with Error Handling and Global Settings

Source: https://openbao.org/docs/agent-and-proxy/agent/template

This example combines global `template_config` settings with specific `template` stanza configurations, including `error_on_missing_key`. This setup causes the agent to exit if a key is missing.

```hcl
template_config {
  exit_on_retry_failure = true
  static_secret_render_interval = "10m"
}

template {
  source      = "/tmp/agent/template.ctmpl"
  destination = "/tmp/agent/render.txt"
  error_on_missing_key = true
}

```

--------------------------------

### Install OpenBao on Arch Linux

Source: https://openbao.org/docs/install

Install OpenBao and its plugins on Arch Linux using pacman.

```bash
$ pacman -Sy openbao
```

```bash
$ pacman -Ss ^openbao-plugin
```

--------------------------------

### Verify OpenBao installation

Source: https://openbao.org/docs/install

Check if OpenBao is installed correctly by running the help command. Ensure the binary is on your system's PATH.

```bash
$ bao -h
```

--------------------------------

### OpenBao Agent Configuration Example

Source: https://openbao.org/docs/agent-and-proxy/agent/process-supervisor

This configuration example demonstrates how to set up auto-authentication using a token file, define environment variables populated with secrets from OpenBao, and configure a child process to be executed.

```hcl
auto_auth {
  
  method {
    type = "token_file"
    
    config {
      token_file_path = "/Users/avean/.vault-token"
    }
  }
}
  
template_config {
  static_secret_render_interval = "5m"
  exit_on_retry_failure         = true
}
  
vault {
  address = "http://localhost:8200"
}
  
env_template "FOO_PASSWORD" {
  contents             = "{{ with secret \"secret/data/foo\" }}{{ .Data.data.password }}{{ end }}"
  error_on_missing_key = true
}
env_template "FOO_USER" {
  contents             = "{{ with secret \"secret/data/foo\" }}{{ .Data.data.user }}{{ end }}"
  error_on_missing_key = true
}
  
exec {
  command                   = ["./my-app", "arg1", "arg2"]
  restart_on_secret_changes = "always"
  restart_stop_signal       = "SIGTERM"
}

```

--------------------------------

### Start OpenBao Agent using Environment Variable

Source: https://openbao.org/docs/agent-and-proxy/agent

Set the BAO_AGENT_CONFIG_PATH environment variable to specify the agent's configuration file, then start the agent.

```bash
$ export BAO_AGENT_CONFIG_PATH=/etc/openbao/agent-config.hcl  

$ bao agent  
```

--------------------------------

### Install OpenBao Go Client Library

Source: https://openbao.org/docs/get-started/developer-qs

Install the official OpenBao client library for Go. This library is used to interact with the OpenBao API from your Go applications.

```bash
$ go get github.com/openbao/openbao/api/v2  
```

--------------------------------

### Example OpenBao Agent Configuration

Source: https://openbao.org/docs/agent-and-proxy/agent

This is a comprehensive example configuration for the OpenBao Agent, demonstrating various stanzas like vault, auto_auth, cache, api_proxy, listeners, and templates.

```hcl
pid_file = "./pidfile"  

vault {
  address = "https://openbao-fqdn:8200"
  retry {
    num_retries = 5
  }
}

auto_auth {
  method "kubernetes" {
    config = {
      role = "foobar"
    }
  }

  sink "file" {
    config = {
      path = "/tmp/file-foo"
    }
  }

  sink "file" {
    wrap_ttl = "5m"
    aad_env_var = "TEST_AAD_ENV"
    dh_type = "curve25519"
    dh_path = "/tmp/file-foo-dhpath2"
    config = {
      path = "/tmp/file-bar"
    }
  }

}

cache {
  // An empty cache stanza still enables caching
}

api_proxy {
  use_auto_auth_token = true
}

listener "unix" {
  address = "/path/to/socket"
  tls_disable = true

  agent_api {
    enable_quit = true
  }
}

listener "tcp" {
  address = "127.0.0.1:8100"
  tls_disable = true
}

template {
  source = "/etc/openbao/server.key.ctmpl"
  destination = "/etc/openbao/server.key"
}

template {
  source = "/etc/openbao/server.crt.ctmpl"
  destination = "/etc/openbao/server.crt"
}

```

--------------------------------

### Start OpenBao Agent Service using Start-Service

Source: https://openbao.org/docs/agent-and-proxy/agent/winsvc

Use this command to start the OpenBao agent Windows service if it is not already running. Successful execution produces no output.

```powershell
PS C:\Windows\system32> Start-Service -Name "OpenBaoAgent"
```

--------------------------------

### Start root token generation

Source: https://openbao.org/docs/commands/operator/generate-root

Initiate the root token generation process using the `-init` flag. Provide the generated OTP with the `-otp` flag. This command starts the process, and subsequent steps will require unseal keys.

```bash
$ bao operator generate-root -init -otp="..."
```

--------------------------------

### Get General CLI Help

Source: https://openbao.org/docs/commands

Command to display general help information for the OpenBao CLI.

```bash
$ bao help
```

--------------------------------

### Example `pkcs11` seal stanza

Source: https://openbao.org/docs/configuration/seal

Illustrates a specific example of a `pkcs11` seal stanza configuration. Environment variables take precedence over configuration file values.

```hcl
seal "pkcs11" {
  
  # ...  

}

```

--------------------------------

### Start OpenBao Debug with Custom Parameters

Source: https://openbao.org/docs/commands/debug

Starts the debug command with specified duration, interval, and metrics interval values, and disables compression. Useful for fine-tuning data collection and reducing output size.

```bash
$ bao debug -duration=1m -interval=10s -metrics-interval=5s -compress=false

```

--------------------------------

### Serve OpenBao Plugin with Multiplexing (Go)

Source: https://openbao.org/docs/plugins/plugin-development

Example main package for an OpenBao plugin using the OpenBao SDK. Requires `github.com/openbao/openbao/sdk v0.5.4` or above. Ensure you replace `your/plugin/import/path` with your actual plugin's import path.

```go
package main  
  
  
import (  
	"os"  

	myPlugin "your/plugin/import/path"  
	"github.com/openbao/openbao/api/v2"  
	"github.com/openbao/openbao/sdk/v2/plugin"  
)  
  
func main() {  
	apiClientMeta := &api.PluginAPIClientMeta{}  
	flags := apiClientMeta.FlagSet()  
	flags.Parse(os.Args[1:])  

	lsConfig := apiClientMeta.GetTLSConfig()  
	lsProviderFunc := api.VaultPluginTLSProvider(tlsConfig)  

	err := plugin.ServeMultiplex(&plugin.ServeOpts{  
		BackendFactoryFunc: myPlugin.Factory,  
		TLSProviderFunc:    tlsProviderFunc,  
	})  
	if err != nil {  
		logger := hclog.New(&hclog.LoggerOptions{})  

		logger.Error("plugin shutting down", "error", err)  
		os.Exit(1)  
	}  

}
```

--------------------------------

### Initialize OpenBao with Default Options

Source: https://openbao.org/docs/commands/operator/init

Starts the OpenBao initialization process using the default configuration settings. This is the simplest way to begin.

```bash
$ bao operator init  

```

--------------------------------

### Load Multiple Configuration Files

Source: https://openbao.org/docs/commands/plugin/init

Initialize plugins by loading configurations from multiple files or directories.

```bash
$ bao plugin init -config=/etc/openbao -config=/opt/openbao/extra.hcl
```

--------------------------------

### Undelete Versions of a Key

Source: https://openbao.org/docs/secrets/kv/kv-v2

Undelete previously soft-deleted versions of a key using the `undelete` command. This example also shows how to verify the undeletion with `bao kv get`.

```bash
$ bao kv undelete -mount=secret -versions=2 my-secret  

Success! Data written to: secret/undelete/my-secret  

$ bao kv get -mount=secret my-secret  

====== Metadata ======
Key              Value
---              -----
created_time     2019-06-19T17:23:21.834403Z
custom_metadata  <nil>
deletion_time    n/a
destroyed        false
version          2

====== Data ======
Key         Value
---         -----
my-value    short-lived-s3cr3t  
```

--------------------------------

### Get Encryption Key Status

Source: https://openbao.org/docs/commands/operator/key-status

Use this command to view the current encryption key's term and installation timestamp. The output is displayed in a table format by default.

```bash
$ bao operator key-status  

Key Term          2  

Install Time      01 Jan 17 12:30 UTC  

Encryption Count  4494  

```

--------------------------------

### Example Containerfile for OpenBao Plugin

Source: https://openbao.org/docs/configuration/plugins

This Containerfile demonstrates how to build a minimal Docker image for an OpenBao plugin, copying the binary and setting the entrypoint.

```dockerfile
FROM scratch
LABEL org.opencontainers.image.source=https://github.com/openbao/openbao-plugins

COPY bin/openbao-plugin-auth-aws_linux_amd64* openbao-plugin-auth-aws

ENTRYPOINT ["/openbao-plugin-auth-aws"]

```

--------------------------------

### Start OpenBao Proxy with Configuration File

Source: https://openbao.org/docs/agent-and-proxy/proxy

Use the `bao proxy` command with the `-config` flag to specify the path to the OpenBao Proxy configuration file.

```bash
$ bao proxy -config=/etc/openbao/proxy-config.hcl  
```

--------------------------------

### Example Ruby Token Helper Script

Source: https://openbao.org/docs/commands/token-helper

This Ruby script demonstrates how to implement a token helper that stores and retrieves tokens in a JSON file, keyed by the VAULT_ADDR environment variable. It handles 'get', 'store', and 'erase' commands.

```ruby
#!/usr/bin/env ruby

require 'json'

unless ENV['VAULT_ADDR']
  STDERR.puts "No VAULT_ADDR environment variable set. Set it and run me again!"
  exit 100
end

begin
  tokens = JSON.parse(File.read("#{ENV['HOME']}/.openbao_tokens"))
rescue Errno::ENOENT => e
  # file doesn't exist so create a blank hash for it
  tokens = {}
end

case ARGV.first
when 'get'
  print tokens[ENV['VAULT_ADDR']] if tokens[ENV['VAULT_ADDR']]
  exit 0
when 'store'
  tokens[ENV['VAULT_ADDR']] = STDIN.read
when 'erase'
  tokens.delete!(ENV['VAULT_ADDR'])
end

File.open("#{ENV['HOME']}/.openbao_tokens", 'w') { |file| file.write(tokens.to_json) }
```

--------------------------------

### OpenBao Configuration Example

Source: https://openbao.org/docs/configuration/plugins

This snippet shows a complete OpenBao configuration, including storage, listener, plugin directory, download behavior, and a specific plugin definition.

```hcl
storage "raft" {
  path = "/opt/openbao/data"
}

listener "tcp" {
  address = "0.0.0.0:8200"
}

plugin_directory = "/opt/openbao/plugins"
plugin_download_behavior = "fail"

plugin "secret" "aws" {
  image       = "ghcr.io/openbao/openbao-plugin-secrets-aws"
  version     = "v1.0.0"
  binary_name = "openbao-plugin-secrets-aws"
  sha256sum   = "9fdd8be7947e4a4caf7cce4f0e02695081b6c85178aa912df5d37be97363144c"
}

```

--------------------------------

### Configure Kubernetes Service Registration with Raft Storage

Source: https://openbao.org/docs/configuration/service-registration

Example of configuring the `service_registration` stanza for Kubernetes alongside the `raft` storage stanza. This setup is useful when you want to use Kubernetes for service discovery but a different system for the storage backend.

```hcl
service_registration "kubernetes" {
  namespace      = "my-namespace"
  pod_name       = "my-pod-name"
}

storage "raft" {
  path = "/path/to/raft/data"
  node_id = "raft_node_1"
}
```

--------------------------------

### Write Command with Multiple Options and Arguments

Source: https://openbao.org/docs/commands

Example demonstrating the 'write' command with multiple options (address, namespace) and arguments (password, policies).

```APIDOC
$ bao write -address="http://127.0.0.1:8200" -namespace="my-organization" \
        auth/userpass/users/bob password="long-password" policies="admin"
```

--------------------------------

### Install OpenBao with Homebrew

Source: https://openbao.org/docs/install

Use Homebrew to install OpenBao on macOS. First, check available information, then proceed with the installation.

```bash
$ brew info openbao
```

```bash
$ brew install openbao
```

--------------------------------

### Install Autocompletion

Source: https://openbao.org/docs/commands

Run this command to install shell autocompletion for the OpenBao CLI. Remember to restart your shell after installation for it to take effect.

```bash
$ bao -autocomplete-install
```

--------------------------------

### Download Plugins with Configuration File

Source: https://openbao.org/docs/commands/plugin/init

Use this command to download plugins by specifying the OpenBao configuration file.

```bash
$ bao plugin init -config=/etc/openbao/openbao.hcl
```

--------------------------------

### Example HCL Plugin Configuration

Source: https://openbao.org/docs/configuration/plugins

An example of an AWS secret plugin declared using HCL syntax. This configuration mirrors the JSON example, specifying OCI image details and checksum.

```hcl
plugin "secret" "aws" {
  image       = "ghcr.io/openbao/openbao-plugin-secrets-aws"
  version     = "v1.0.0"
  binary_name = "openbao-plugin-secrets-aws"
  sha256sum   = "9fdd8be7947e4a4caf7cce4f0e02695081b6c85178aa912df5d37be97363144c"
}
```

--------------------------------

### Install Specific Version of OpenBao Helm Chart

Source: https://openbao.org/docs/platform/k8s/helm

Install a specific version of the OpenBao Helm chart. Replace `0.4.0` with the desired chart version. Always use `--dry-run` before installing.

```bash
# Install version 0.4.0
$ helm install openbao openbao/openbao --version 0.4.0
```

--------------------------------

### Initialize OCI-based Plugins

Source: https://openbao.org/docs/commands/plugin

Downloads and initializes OCI-based plugins configured in the server's configuration file. Ensure the configuration path is correctly specified.

```bash
$ bao plugin init -config=/etc/openbao/openbao.hcl  

2025-09-17T21:41:35.311+0200 [INFO]  Plugin directory: /opt/openbao/plugins  

2025-09-17T21:41:35.311+0200 [INFO]  Found 2 OCI plugin(s) in configuration  

2025-09-17T21:41:35.311+0200 [INFO]  downloading plugin from OCI registry: plugin=secrets-aws url=ghcr.io/openbao/openbao-plugin-secrets-aws:v0.0.1  

2025-09-17T21:41:36.537+0200 [INFO]  found plugin binary in OCI image: plugin=secrets-aws entry=openbao-plugin-secrets-aws size=23265572  

2025-09-17T21:41:37.448+0200 [INFO]  successfully downloaded and validated plugin: plugin=secrets-aws cached_path=/opt/openbao/plugins/.oci-cache/secrets-aws/c8d23e6d/openbao-plugin-secrets-aws symlink_path=/opt/openbao/plugins/secrets-aws hash=c8d23e6d31be2a59d0c269bb7243158c4c61c5073f7ba50ce6f1a0050e023e2d  

2025-09-17T21:41:37.449+0200 [INFO]  downloading plugin from OCI registry: plugin=secrets-nomad url=ghcr.io/openbao/openbao-plugin-secrets-nomad:v0.1.3-dev2  

2025-09-17T21:41:38.838+0200 [INFO]  found plugin binary in OCI image: plugin=secrets-nomad entry=openbao-plugin-secrets-nomad size=16289976  

2025-09-17T21:41:39.657+0200 [INFO]  successfully downloaded and validated plugin: plugin=secrets-nomad cached_path=/opt/openbao/plugins/.oci-cache/secrets-nomad/b7f2db3c/openbao-plugin-secrets-nomad symlink_path=/opt/openbao/plugins/secrets-nomad hash=b7f2db3cbba3df7b4c2868c7c18e43956862b7cd69f90a96bdbba6a3013e400b  
```

--------------------------------

### Install OpenBao with CSI Enabled

Source: https://openbao.org/docs/platform/k8s/csi/installation

Installs the OpenBao Helm chart and enables the CSI provider by setting the `csi.enabled` value to `true`. This command also installs the OpenBao server and Agent Injector.

```bash
$ helm install openbao openbao/openbao --set="csi.enabled=true"
```

--------------------------------

### Enable and Configure Database Plugin

Source: https://openbao.org/docs/upgrading/plugins

Enable the database plugin and write its initial configuration, specifying the plugin name.

```bash
$ bao secrets enable database
$ bao write database/config/my-db \
    plugin_name=my-db-plugin \
    # ...
```

--------------------------------

### Bootstrap OpenBao project

Source: https://openbao.org/docs/install

Download and compile necessary libraries and tools for building OpenBao from source.

```bash
make bootstrap
```

--------------------------------

### Install cert-manager with Helm

Source: https://openbao.org/docs/platform/k8s/helm/examples/injector-tls-cert-manager

Install cert-manager using Helm. Ensure you have added the jetstack Helm repository and updated it.

```bash
$ helm repo add jetstack https://charts.jetstack.io  

$ helm repo update  

$ helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --set installCRDs=true  

```

--------------------------------

### Azure AD Claims Example

Source: https://openbao.org/docs/auth/jwt/oidc-providers/azuread

Example of claims returned by Azure AD when a user is a member of more than 200 groups.

```json
{
  "_claim_names": {
    "groups": "src1"
  },
  "_claim_sources": {
    "src1": {
      "endpoint": "https://graph.windows.net...."
    }
  }
}
```

--------------------------------

### Initialize OpenBao with PGP Keys

Source: https://openbao.org/docs/concepts/pgp-gpg-keybase

Initialize OpenBao with a specified number of key shares and a threshold for unsealing, using a list of PGP public keys provided as base64 encoded files.

```bash
$ bao operator init -key-shares=3 -key-threshold=2 \
    -pgp-keys="jeff.asc,vishal.asc,seth.asc"
```

--------------------------------

### List all available plugins

Source: https://openbao.org/docs/commands/plugin/list

Use this command to list all plugins available in the Openbao plugin catalog. The output includes the plugin name, type, and version.

```bash
$ bao plugin list  

Name                                 Type        Version  

----                                 ----        -------  

approle                              auth        v1.14.8+builtin.bao  

# ...  
```

--------------------------------

### Bound Claims Configuration Example

Source: https://openbao.org/docs/auth/jwt

Configure arbitrary claims to be matched against the JWT. This example shows matching 'division' and 'department' claims.

```json
{
  "division": "Europe",
  "department": "Engineering"
}
```

--------------------------------

### Allow 'bar' parameter starting with 'foo-*'

Source: https://openbao.org/docs/concepts/policies

This policy allows 'create' capability on 'secret/foo' and restricts the 'bar' parameter to values starting with 'foo-'.

```hcl
path "secret/foo" {
  capabilities = ["create"]
  allowed_parameters = {
    "bar" = ["foo-*"]
  }
}
```

--------------------------------

### Initialize OpenBao with Keybase PGP Keys

Source: https://openbao.org/docs/concepts/pgp-gpg-keybase

Use the `keybase:` prefix with the `-pgp-keys` argument to initialize OpenBao with PGP keys managed by Keybase. This encrypts unseal keys for specified Keybase users.

```bash
$ bao operator init -key-shares=3 -key-threshold=2 \
    -pgp-keys="keybase:jefferai,keybase:vishalnayak,keybase:sethvargo"
```

--------------------------------

### Bound Claims with List Configuration Example

Source: https://openbao.org/docs/auth/jwt

Configure a claim to match one of the values in a list. This example limits authorization to specific email addresses.

```json
{
  "email": ["fred@example.com", "julie@example.com"]
}
```

--------------------------------

### Initialize OpenBao Server

Source: https://openbao.org/docs/platform/k8s/helm/run

Initialize a single OpenBao server using the CLI. This generates the necessary key shares and root token for unsealing.

```bash
$ kubectl exec -ti openbao-0 -- bao operator init
```

--------------------------------

### Serve Non-Multiplexed Plugin with Go SDK

Source: https://openbao.org/docs/secrets/databases/custom

Use `Serve` from `sdk/database/dbplugin/v5` to serve non-multiplexed plugins. The setup is identical to the multiplexed case, except for the `Run` function.

```go
func Run() error {  
	dbType, err := New()  
	if err != nil {  
		return err  
	}

	dbplugin.Serve(dbType.(dbplugin.Database))  

	return nil  
}
```

--------------------------------

### Install OpenBao in External Mode

Source: https://openbao.org/docs/platform/k8s/helm/run

Installs the OpenBao Helm chart in external mode, which does not deploy an OpenBao server but relies on an existing, network-addressable OpenBao server.

```bash
$ helm install openbao openbao/openbao \
    --set "injector.externalVaultAddr=http://external-openbao:8200"
```

--------------------------------

### Initialize OpenBao Client with Token Authentication (Go)

Source: https://openbao.org/docs/get-started/developer-qs

Initialize a new OpenBao client in Go using token-based authentication. Configure the client to connect to the OpenBao server address and set the authentication token.

```go
config := openbao.DefaultConfig()  
  
config.Address = "http://127.0.0.1:8200"  
  
client, err := openbao.NewClient(config)  

if err != nil {  

    log.Fatalf("unable to initialize OpenBao client: %v", err)  

}
  
client.SetToken("dev-only-token")  
```

--------------------------------

### Install Latest OpenBao Helm Chart

Source: https://openbao.org/docs/platform/k8s/helm

Install the latest release of the OpenBao Helm chart. It is recommended to use `--dry-run` first to verify changes before applying them.

```bash
$ helm install openbao openbao/openbao
```

--------------------------------

### CelProgram Example with Variables

Source: https://openbao.org/docs/concepts/cel

An example of a CelProgram configuration, including a list of CelVariables and the main expression. Variables are evaluated in order and can be referenced by later variables or the main expression.

```json
"cel_program": map[string]interface{}{
  "variables": []map[string]interface{}{
    {
      "name":       "validate_cn",
      "expression": `has(request.common_name) && request.common_name == "example.com"`,
    },
    {
      "name":       "small_ttl",
      "expression": `has(request.ttl) && duration(request.ttl) < duration("4h")`,
    },
    {
      "name":       "cn_value",
      "expression": "request.common_name",
    },
    {
      "name":       "not_after",
      "expression": "now + duration(request.ttl)",
    },
    {
      "name": "cert",
      "expression": `CertTemplate{
        Subject: PKIX.Name{
        CommonName: cn_value,
        },
        NotBefore: now,
        NotAfter: not_after,
      }`,
    },
    {
      "name": "output",
      "expression": `ValidationOutput{
        template:        cert,
        generate_lease:  small_ttl,
        no_store:        !small_ttl,
      }`,
    },
    {
      "name":       "err",
      "expression": "'Request should have common_name'",
    },
  },
  "expression": "validate_cn ? output : err",
}
```

--------------------------------

### List All Auth Methods

Source: https://openbao.org/docs/commands/auth/list

Use this command to see a basic list of all enabled authentication methods and their types. This is useful for a quick overview of available authentication options.

```bash
$ bao auth list  

Path         Type        Description  

----         ----        -----------  
token/       token       token based credentials  
userpass/    userpass    n/a  
```

--------------------------------

### Example of an Elided Audit Response

Source: https://openbao.org/docs/audit

This example shows an audit record after the `elide_list_responses` feature has processed it. The `keys` and `key_info` fields are replaced with integers representing the count of entries.

```json
{
  "type": "response",
  "request": {
    "operation": "list"
  },
  "response": {
    "data": {
      "key_info": 4,
      "keys": 4
    }
  }
}
```

--------------------------------

### Configure a Role for PKI

Source: https://openbao.org/docs/secrets/pki/quick-start-root-ca

Configure a role to map policies for generating credentials. This example creates a role named 'example-dot-com' with specific domain and TTL settings.

```bash
$ bao write pki/roles/example-dot-com \
    allowed_domains=example.com \
    allow_subdomains=true max_ttl=72h  
Success! Data written to: pki/roles/example-dot-com  
```

--------------------------------

### Install OpenBao in HA Mode

Source: https://openbao.org/docs/platform/k8s/helm/run

Installs the OpenBao Helm chart in High Availability (HA) mode, configuring three OpenBao servers with an existing Integrated Storage backend.

```bash
$ helm install openbao openbao/openbao \
    --set "server.ha.enabled=true"
```

--------------------------------

### Kubernetes Service Registration Configuration Example

Source: https://openbao.org/docs/configuration/service-registration

A specific example of configuring the `service_registration` stanza for the Kubernetes provider. Environment variables will take precedence over values set in the configuration file.

```hcl
service_registration "kubernetes" {
  namespace      = "my-namespace"
  pod_name       = "my-pod-name"
}
```

--------------------------------

### Custom OpenBao Readiness Probe

Source: https://openbao.org/docs/platform/k8s/helm/run

Configure a custom readiness probe for OpenBao pods to consider them ready even when uninitialized or sealed. This allows for `postStart` scripts to run.

```yaml
server:
  readinessProbe:
    enabled: true
    path: '/v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204'
```

--------------------------------

### Install OpenBao Helm Chart with HA and Raft Enabled (CLI)

Source: https://openbao.org/docs/platform/k8s/helm/terraform

Use this CLI command to install the OpenBao Helm chart with High Availability and Integrated Storage (Raft) enabled.

```bash
$ helm install openbao openbao/openbao \
  --set='server.ha.enabled=true' \
  --set='server.ha.raft.enabled=true'
```

--------------------------------

### Display OpenBao Version with `version` Command

Source: https://openbao.org/docs/commands/version

Use the `version` command to print the OpenBao version. This is the most straightforward way to check the installed version.

```bash
$ bao version  

OpenBao v1.2.3  

```

--------------------------------

### Write User with Multiple Options and Arguments

Source: https://openbao.org/docs/commands

Demonstrates the 'write' command with multiple options like '-address' and '-namespace', and multiple arguments like 'password' and 'policies'.

```bash
$ bao write -address="http://127.0.0.1:8200" -namespace="my-organization" \

        auth/userpass/users/bob password="long-password" policies="admin"
```