Create isolated secret namespaces for multiple teams using separate KV mounts and restrictive policies. Configure Kubernetes auth roles that bind namespace-specific ServiceAccounts to team-scoped policies, ensuring pods in one tenant cannot access another tenant's secrets.
Prerequisites checklist
Confirm these before running steps:
- OpenBao deployed and unsealed with admin access
- Kubernetes auth method enabled and configured
1Create team namespaces and ServiceAccounts
We will use them for this test case
oc new-project team-alphaoc new-project team-betaoc create serviceaccount team-alpha-sa -n team-alphaoc create serviceaccount team-beta-sa -n team-beta2Create separate KV mounts for each team
Team Alpha:
bao secrets enable -path=team-alpha kv-v2Team Beta:
bao secrets enable -path=team-beta kv-v23Write sample secrets for each team
Team Alpha:
bao kv put team-alpha/app/config db_host=alpha-db.svc api_key=alpha-key-123Team Beta:
bao kv put team-beta/app/config db_host=beta-db.svc api_key=beta-key-456→ Success: This will create the secrets in the appropriate path. For example: team-alpha/data/app/config
4Create team-scoped policies
This will allow the team to read and write secrets into their own path
Team Alpha:
bao policy write policy-team-alpha -<<'EOF'
path "team-alpha/data/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
path "team-alpha/metadata/*" {
capabilities = ["list", "read"]
}
path "team-beta/*" {
capabilities = ["deny"]
}
EOFTeam Beta:
bao policy write policy-team-beta -<<'EOF'
path "team-beta/data/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
path "team-beta/metadata/*" {
capabilities = ["list", "read"]
}
path "team-alpha/*" {
capabilities = ["deny"]
}
EOF5Create Kubernetes auth roles binding namespace SAs to policies
This links each team's ServiceAccount to its policy so pods can log in to OpenBao and only reach their own secrets.
Team Alpha:
bao write auth/kubernetes/role/team-alpha \
bound_service_account_names=team-alpha-sa \
bound_service_account_namespaces=team-alpha \
policies=policy-team-alpha \
ttl=1hTeam Beta:
bao write auth/kubernetes/role/team-beta \
bound_service_account_names=team-beta-sa \
bound_service_account_namespaces=team-beta \
policies=policy-team-beta \
ttl=1h6Deploy test pods in both namespaces
Apply from the Commands / YAML tab.
Wait for the pods to be ready
oc wait --for=condition=Ready pod/test-pod -n team-alpha --timeout=120soc wait --for=condition=Ready pod/test-pod -n team-beta --timeout=120s7Test: pod in team-alpha can read team-alpha secrets
Run inside the pod
oc exec -it test-pod -n team-alpha -- shRun the following commands once you are inside the pod
# get the JWT token from the service account
JWT=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
# login to OpenBao
LOGIN_RESP=$(curl -sSk --request POST \
--data "{\"jwt\":\"$JWT\",\"role\":\"team-alpha\"}" \
https://openbao.openbao.svc:8200/v1/auth/kubernetes/login)
# get the token from the login response
TOKEN=$(printf '%s' "$LOGIN_RESP" | sed -n 's/.*"client_token"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
# read the secrets from the team-alpha path using the token
curl -sSk -H "X-Vault-Token: $TOKEN" \
https://openbao.openbao.svc:8200/v1/team-alpha/data/app/config→ Success: Team-alpha can read their own secrets
8Test: pod in team-alpha CANNOT read team-beta secrets
Same shell; expect permission denied (HTTP 403).
# read the secrets from the team-beta path using the token
curl -sSk -H "X-Vault-Token: $TOKEN" \
https://openbao.openbao.svc:8200/v1/team-beta/data/app/config→ Success: Team-alpha CANNOT read team-beta secrets
9Cleanup (Full: delete namespaces and everything in OpenBao)
oc delete project team-alphaoc delete project team-betabao secrets disable team-alphabao secrets disable team-betabao policy delete policy-team-alphabao policy delete policy-team-beta