OpenStack Barbican
OpenStack Barbican is a key management service for securely storing, provisioning, and managing secrets such as keys, certificates, passwords, and binary data.
What OpenStack Barbican is
OpenStack Barbican is a key management service for securely storing, provisioning, and managing secrets such as keys, certificates, passwords, and binary data. Its barbican-api component provides an OpenStack-native REST API, while barbican-worker and barbican-keystone-listener are also part of the service. A plugin architecture connects Barbican to software-based secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, Vault, and PKCS#11 crypto plugins; PKCS#11 can keep master encryption and HMAC keys in an HSM. Operators may also develop plugins for storage, generation, and event handling, though plugin support can be stable, experimental, or out-of-tree. The Keystone listener manages Barbican database records when Keystone projects are deleted. A key security consideration is that the default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so access to service nodes must be restricted carefully. Container ACL settings do not pass to associated secrets, and ACL functionality requires Keystone integration. Barbican is free and open source under Apache 2.0; its installation documentation assumes a working OpenStack deployment.
Good
- Provides an OpenStack-native REST API for secrets.
- Plugin architecture supports software stores and HSMs.
- PKCS#11 can keep master keys in an HSM.
- Operators can develop custom plugins.
- Free and open source under Apache 2.0.
Watch out
- Installation assumes a working OpenStack deployment.
- Default Simple Crypto key is stored in plaintext.
- Container ACL settings do not apply to associated secrets.
- ACL functionality requires Keystone integration.
Who it suits
Barbican suits OpenStack operators who need secret management through an API and can configure its plugins and deployment requirements. It is relevant where software stores or HSM-backed secret storage are needed.
Verdict
Barbican provides OpenStack-native secret management with plugin options for software stores and HSMs. Operators should review its default key handling and ACL limitations when planning a deployment.
Plans and prices
From OpenStack Barbican's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Open source Barbican | Free | No plan limits stated |
The facts
Each one read from OpenStack Barbican's own pages, with the date it was checked.
What it does
- ACL limitation
- Container ACL settings are not propagated to associated secrets, and ACL functionality applies only when Barbican is integrated with Keystone.checked 4 Oct 2026
- API
- The barbican-api service provides an OpenStack-native REST API for provisioning and managing secrets.checked 4 Oct 2026
- Components
- The service includes barbican-api, barbican-worker, and barbican-keystone-listener components.checked 4 Oct 2026
- Customization
- Operators can develop custom plugins for secret storage, generation, and event handling; plugin support status can be stable, experimental, or out-of-tree.checked 4 Oct 2026
- Deployment requirement
- The installation documentation assumes a working OpenStack deployment.checked 4 Oct 2026
- HSM support
- The PKCS#11 crypto plugin interfaces with a Hardware Security Module, with master encryption and HMAC keys residing in the HSM.checked 4 Oct 2026
- Integrations
- Documented secret-store plugins include KMIP, Dogtag, and Vault, alongside PKCS#11 crypto plugins.checked 4 Oct 2026
- Keystone
- The Keystone listener manages Barbican database representations of Keystone projects when those projects are deleted.checked 4 Oct 2026
- License
- The OpenStack project is provided under the Apache 2.0 license.checked 4 Oct 2026
- Purpose
- Barbican is the OpenStack Key Manager service for secure storage, provisioning, and management of secrets such as keys, certificates, passwords, and raw binary data.checked 4 Oct 2026
- Secret stores
- A plugin architecture lets operators store secrets in software-based stores or hardware devices such as HSMs.checked 4 Oct 2026
- Security tradeoff
- The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so access to service nodes must be restricted carefully.checked 4 Oct 2026
Alternatives to OpenStack Barbican
- 1
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 2
Utimaco Enterprise Secure Key Manager
WebAPILinuxSelf-hosted6.5 - 3
Cryptsoft KMIP Server
WebAPILinuxSelf-hosted6.0 - 4
Kleopatra
Free planLinuxWindows6.0Free plan - 5
5.9From $1 a month - 6
Fornetix Key Orchestration Platform
WebAPILinuxSelf-hosted5.9