OpenStack Barbican

OpenStack Barbican is a self-hosted key manager for operators who already run OpenStack and want to manage secrets through its native API. Its storage plugins allow a choice of software stores or HSM-backed custody, but teams must own the deployment and secure the service nodes.

Overview

Barbican handles encryption keys, certificates, passwords and raw binary data. Its REST API provisions and manages these secrets within OpenStack. The service combines an API, a worker and a Keystone listener; the listener updates Barbican’s database representation of a project when Keystone deletes it.

This is a fit for OpenStack operators, not a turnkey vault for teams without an existing OpenStack deployment. Installation documentation assumes that foundation is already working, placing deployment and ongoing security responsibilities with the operator.

Key features

Storage choice and HSM support

A plugin architecture supports software-based stores and hardware devices. Documented integrations include KMIP, Dogtag and Vault, alongside PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys reside in an HSM, making Barbican relevant where hardware-backed key custody matters. Plugin support can be stable, experimental or out-of-tree, so operators should account for integration maturity.

Security and access controls

The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf. That makes access to service nodes a critical security boundary; the default is not a reason to treat the deployment as secure without careful restriction. Container ACL settings also do not carry over to associated secrets, and ACL functionality applies only when Barbican is integrated with Keystone. Teams relying on container settings to govern secret access should plan for that limitation.

Operator extensibility

Operators can develop plugins for secret storage, generation and event handling. This flexibility can accommodate deployment-specific needs, but custom plugins add work and plugin maturity varies.

Pricing

Barbican is open source under the Apache 2.0 license. The Open source Barbican plan costs nothing, with no plan limits stated. There is no free trial; the software is free rather than a time-limited evaluation. This suits teams able to operate it themselves, while teams seeking a managed service or supported deployment should compare alternatives.

Platforms

Barbican supports API, Linux and self-hosted deployment. Its self-hosted model aligns with operator control, but also means teams need to provide and maintain the OpenStack environment it assumes.

Who it's for

Choose Barbican if you operate OpenStack and want its REST API, configurable secret stores or HSM integration under your own control. Look elsewhere if you need a standalone vault, managed hosting, or container ACLs that automatically govern associated secrets.

Pros and cons

Pros

• Open source and free, with self-hosted deployment for teams that want control over their environment.
• Storage plugins include software stores and HSM options, with PKCS#11 placing master encryption and HMAC keys in the HSM.
• Custom plugins can extend storage, generation and event handling to suit operator needs.

Cons

• Installation assumes a working OpenStack deployment, narrowing its fit for teams without that infrastructure.
• The default Simple Crypto key is stored in plaintext in barbican.conf, requiring strict limits on service-node access.
• Container ACL settings do not propagate to associated secrets, and ACLs require Keystone integration.

Alternatives

Consider Thales CipherTrust Data Security Platform if you want a free Community Edition and a free trial across API, Linux, self-hosted and web platforms.

Oracle Cloud Infrastructure Secret Management is another free option, with 5,000 secrets per tenancy and 30 active versions per secret.

Tencent Cloud API Gateway may suit API users seeking a free first-year allowance of one million calls per month, with excess calls and outbound traffic billed on a pay-as-you-go basis.

Bloombase KeyCastle is a paid option with a free trial.

CrystalKey 360 is a paid alternative for API, Linux, self-hosted, web and Windows platforms.

Entrust Certificate Manager is a paid option without a free plan, with pricing discussed with Entrust experts.

Utimaco Enterprise Secure Key Manager is a paid alternative with client licensing described as independent of key volume and scalability.

AWS Key Management Service may suit API and web users willing to pay $1 a month per KMS key, with API requests charged separately and a 20,000-request monthly free tier across Regions.

For broader comparisons, browse Encryption Key Management Software, Key Management Software, Virtualization Management Software, Cloud Automation Software, Cloud Management Software and Secrets Management Tools.

Verdict

Barbican is a strong fit for OpenStack operators who want a free, extensible key manager and the option of HSM-backed keys. Its main reason to choose is control over secret-storage integrations; its main reason to look elsewhere is the operational burden, especially securing the default plaintext key and working around ACL limits.