OpenBao

Move secrets to and from one OpenBao KV v2 path.

The connection

What	This provider
Vendor	OpenBao
Key	`openbao-kv`
Availability	`available`. You can connect it today.
Credential penv holds	`openbao-token`
Values read back	yes
Activation	`immediate`

Direction	What it does
`import`	Reads names and values out of the store into penv.
`export`	Writes names and values from penv into the store.

immediate. The running app sees a new value at once.

Direction	Policies you can pick
`import`	`skip_existing`, `new_version`, `fail`
`export`	`create_only`, `overwrite`, `overwrite_and_prune`

How syncs work says what each one does.

You paste a credential you already hold. penv seals it and never shows it again.

Field	Label	Kind	Required	What it is
`token`	OpenBao token	secret, masked here and sealed	yes	OpenBao tokens expire, exactly as Vault's do. Use one with a lease long enough for your sync schedule, and renew it.

Fixed when you connect, and shared by every mapping on it.

Field	Label	Kind	Required	Advanced	What it is
`address`	Vault address	text	yes	no	Must be reachable from the public internet over HTTPS.
`namespace`	Namespace	text	no	yes	Enterprise and HCP only. Leave empty for open-source Vault.

Answered once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`mount`	KV mount	text	yes	no	Must be a KV version 2 mount.
`path`	Path	text	yes	no	One path per sync. Every key stored there is one secret here.

penv probes for these when it verifies the connection.

Permission	Directions	Blocking	Without it
`read`	`import`	yes	Import cannot read the path.
`create`	`export`	yes	Export cannot write a path that does not exist yet.
`patch`	`export`	yes	Export cannot change a path without replacing everything else stored there.