VMware Secrets Manager

Free plan APILinuxSelf-hosted

Visit VMware Secrets Manager Alternatives Pricing

What VMware Secrets Manager is

VMware Secrets Manager (VSecM) is a free, open-source secrets store for Kubernetes workloads. It stores configuration and delivers secrets using workload identity based on SPIFFE; SPIRE is the default identity control plane, and other SPIFFE-compatible options can be used. Secrets can reach workloads through a sidecar, init container, SDK, or Kubernetes Secret. Operators can change them at runtime without rebooting workloads, and the SDK can retrieve rotated values without an application restart or eviction. VSecM records when secrets are created and updated, retains version history, supports GoLang transformations, and can interpolate stored secrets onto Kubernetes Secrets. Federation lets teams share secrets across namespaces and clusters.

Plaintext values are held in memory, while data written to disk and backups is encrypted. Production documentation describes age encryption, or AES-256-GCM when FIPS compliance is enabled. Workloads can keep using existing secrets through a component failure, and the component can restore state from an encrypted backup. Installation is into a Kubernetes cluster with Helm charts or Makefile targets. The project is in active maintenance mode, with new feature work deferred while development focuses on SPIKE v1.0.

Who it suits

VSecM suits teams that operate Kubernetes and need to distribute, rotate, version, or federate workload secrets. It is a fit for teams using SPIFFE-compatible identity and self-hosted deployment; it is not designed for use outside Kubernetes or as a standalone binary.

What it does well

Free and open source under the BSD 2-Clause License.
Deliver secrets through a sidecar, init container, SDK, or Kubernetes Secret.
Change and rotate secrets without restarting workloads.
Retain secret versions and creation and update timestamps.
Federate secrets across namespaces and clusters.
Continue using existing secrets during component failure.

What to know first

Requires a running Kubernetes cluster; no standalone mode.
Plaintext secret capacity depends on allocated memory.
New feature implementations are deferred during active maintenance mode.

Limits

Plaintext secrets are held in memory, so capacity is limited by the memory allocated to VSecM Safe. If operators opt out of Kubernetes Secrets for root-key protection, they must provide the root key again after a restart, eviction, crash, or rescheduling.

Plans

Plan	Billed and limits	Price
Free and open source	BSD 2-Clause licensed · designed to run on Kubernetes	Free

As vsecm.com lists them, read 11 Oct 2026. The maker's own page has the final word.

Getting started

Open https://vsecm.com/.
Prepare a running Kubernetes cluster with Helm, kubectl, and make.
Install VSecM into the cluster using Helm charts or Makefile targets.
Choose a delivery method: sidecar, init container, SDK, or Kubernetes Secret.
Configure SPIRE or another SPIFFE-compatible identity control plane.

Verdict

Choose VSecM if you need a self-hosted Kubernetes secrets store with multiple delivery options, secret versioning, and runtime rotation. Look elsewhere if you need a standalone or non-Kubernetes deployment, or if deferred feature development does not suit your plans.

Questions

How much does VMware Secrets Manager cost?

The free and open-source plan is free.

What platforms does VSecM support?

It is designed for API, Linux, and self-hosted use, and runs only on Kubernetes.

Is VMware Secrets Manager open source?

Yes. Its code is distributed under the BSD 2-Clause License.

How are secrets delivered to workloads?

They can be delivered through a sidecar, init container, SDK, or Kubernetes Secret.

How does VSecM protect stored secrets?

Plaintext secrets are held in memory, while data saved to disk and backups is encrypted. Production documentation describes age encryption or AES-256-GCM in FIPS-compliant environments.

How can I get help or report an issue?

The project directs users to its Slack workspace for questions and community help, and to GitHub Issues for bug reports, feature requests, or questions.

Facts from VMware Secrets Manager's own pages

Compatibility: VSecM is designed to run on Kubernetes only and is not intended to run outside Kubernetes or as a standalone binary. · vsecm.com, 11 Oct 2026
Data protection: Sensitive data is stored in memory, while data saved to disk and backups are encrypted. · vsecm.com, 5 Oct 2026
Encryption: The production documentation says VSecM Safe encrypts secrets using age, or AES-256-GCM in FIPS-compliant environments. · vsecm.com, 11 Oct 2026
Federation: VSecM supports federation of secrets across namespaces and clusters. · vsecm.com, 5 Oct 2026
FIPS mode: FIPS mode is off by default and can be enabled by setting VSECM_SAFE_FIPS_COMPLIANT to true. · vsecm.com, 11 Oct 2026
Identity: VSecM uses SPIFFE as its identity control plane for workload authentication. · vsecm.com, 5 Oct 2026
Identity integration: VSecM uses SPIRE as its default identity control plane, and SPIFFE-compatible identity control planes can also be used. · vsecm.com, 11 Oct 2026
Installation: VSecM installs into a Kubernetes cluster using Helm charts or Makefile targets; the documented prerequisites include Helm, kubectl, a running cluster, and make. · vsecm.com, 5 Oct 2026
Kubernetes requirement: VSecM is designed to run only on Kubernetes, not as a standalone binary or outside Kubernetes. · vsecm.com, 5 Oct 2026
Legacy workloads: VSecM can create Kubernetes Secret objects for workloads that cannot use its SDK or Sidecar integration. · vsecm.com, 11 Oct 2026
License: The VSecM code is distributed under the BSD 2-Clause License. · vsecm.com, 5 Oct 2026
No admin token: VSecM requires no admin token for operation, though users may provide a root token and then manually unlock after a crash. · vsecm.com, 5 Oct 2026
Operational limit: VSecM Safe keeps plaintext secrets in memory, so the quantity of secrets is limited by the memory allocated to it. · vsecm.com, 11 Oct 2026
Project status: The project says it is in active maintenance mode, prioritizing security fixes while deferring new feature development until SPIKE reaches v1.0. · vsecm.com, 11 Oct 2026
Purpose: VMware Secrets Manager is a Kubernetes-native key-value store for securely storing and dispatching secrets to cloud-native workloads. · vsecm.com, 11 Oct 2026
Resilience: Workloads can continue using existing secrets when a VSecM component fails, and the component can recover state from an encrypted backup. · vsecm.com, 5 Oct 2026
Resource limits: The project notes that in-memory storage limits capacity and says a couple of gigabytes of RAM can hold many plain-text secrets. · vsecm.com, 5 Oct 2026
Rotation: The VSecM SDK can retrieve rotated secrets without requiring the application to restart or be evicted. · vsecm.com, 11 Oct 2026
Secret delivery: Secrets can be delivered to workloads with the VSecM SDK, Sidecar, or Init Container, or persisted as Kubernetes Secret objects. · vsecm.com, 11 Oct 2026
Secret history: VSecM records creation and update timestamps and keeps version history for secrets. · vsecm.com, 5 Oct 2026
Secretless mode: If operators opt out of Kubernetes Secrets for root-key protection, they must manually provide the root key again after VSecM Safe restarts or is evicted, crashes, or rescheduled. · vsecm.com, 11 Oct 2026
Security: Plaintext secrets are held in memory, while data VSecM saves to disk is encrypted. · vsecm.com, 11 Oct 2026
Security response: The stated target is to fix confirmed medium-or-higher severity vulnerabilities within 60 days and respond initially to vulnerability reports within 14 days. · vsecm.com, 5 Oct 2026
Support: The project directs users to its Slack workspace for questions and community help, and to GitHub Issues for bug reports, feature requests, or questions. · vsecm.com, 11 Oct 2026

Where VMware Secrets Manager stands on Freedom251

Secrets Management Tools#22 of 46