HashiCorp's Vault License Changes (preliminary announcement)

[sagikazarmark]

Dear Bank-Vaults Community,

Many of you have voiced concerns or posed questions regarding HashiCorp Vault's recent license change and its implications for both Bank-Vaults and end-users. Although we are not yet ready to make a final decision, we are diligently gathering feedback and information from various sources. In the meantime, we felt it necessary to address the situation and provide an update.

As many of you are aware, Bank-Vaults interfaces with Vault in several ways:

• The Bank-Vaults CLI streamlines Vault configuration.
• Through the Vault Operator, we've enabled seamless operation of Vault on Kubernetes.
• Our Vault Secrets Webhook facilitates the direct injection of secrets from Vault into Kubernetes pods.

One of our core uncertainties revolves around the vagueness in the new license, especially terms like "embedding" and "competing offer". Who precisely determines the meaning and scope of these terms? It's plausible that HashiCorp might have the final say. While they might assure us today that our usage is compliant, what guarantees do we have about future interpretations?

Several factors will influence our final assessment of this license change:

• Bank-Vaults' CNCF Proposal: We are proposing Bank-Vaults to be considered as a sandbox project under the Cloud Native Computing Foundation (CNCF). The CNCF's guidance on using BUSL licensed software will significantly influence our future decisions.
• CNCF Guidelines: Should Bank-Vaults be accepted into the CNCF, we will need to adhere strictly to the foundation's directives on leveraging BUSL licensed software.
• Legal Analysis: We are in the process of obtaining a comprehensive analysis from our legal department regarding the implications of these license changes.

In the interim, we wish to provide assurance to both developers and end-users. We are confident that continuing to use MPL licensed versions of Vault is in compliance with that license. Until we can offer a definitive stance on the recent license changes, we strongly recommend that our community stick to the MPL-licensed versions, especially if they are running the community edition.

We deeply value the trust and support you've placed in Bank-Vaults. Rest assured, we are working diligently to navigate these changes and will keep the community informed every step of the way.

Warm Regards,
The Bank-Vaults Development Team

[camaeel]

@sagikazarmark

Any updates on this topic?

[tvsaru]

Worth noting that Hashicorp Vault has been forked as OpenBao.

https://www.theregister.com/AMP/2023/12/08/hashicorp_openbao_fork/

Does that change things?

[csatib02]

About OpenBao support in Bank-Vaults: https://github.com/orgs/bank-vaults/discussions/2594#discussioncomment-8937824

[Elyytscha]

as we are a little bit concerned about the future of the project, an update would be nice

[sagikazarmark]

The team is going to sit down next week to discuss our options and future plans. We will provide an update afterwards.

[sagikazarmark]

Apologies for dropping the ball on this.

We've been busy getting the project accepted to the CNCF: cncf/sandbox#54

We will provide an update about both BUSL and the future of the project soon.

tl;dr We are confident that using Bank-Vaults with HashiCorp Vault (even BUSL versions) is safe. With the updated license clarifying what constitutes embedding, we are confident that our usage does not.

Of course, the IBM acquisition could still change things: maybe they revert the license change? The future of OpenBao may also be a question.