Skip to content
SPECIFICTION
Get listed

OpenStack Barbican

docs.openstack.org

Free plan LinuxAPISelf-hosted
Visit docs.openstack.org
Spec score 7.6 #9 of 24 in Encryption Key Management Software

What it is

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.

Spec sheet

Purpose
Barbican is the OpenStack Key Manager service for secure storage, provisioning, and management of secrets such as keys, certificates, passwords, and raw binary data.Read 4 Oct 2026 · docs.openstack.org
API
The barbican-api service provides an OpenStack-native REST API for provisioning and managing secrets.Read 4 Oct 2026 · docs.openstack.org
Integrations
Documented secret-store plugins include KMIP, Dogtag, and Vault, alongside PKCS#11 crypto plugins.Read 4 Oct 2026 · docs.openstack.org
License
The OpenStack project is provided under the Apache 2.0 license.Read 4 Oct 2026 · docs.openstack.org
ACL limitation
Container ACL settings are not propagated to associated secrets, and ACL functionality applies only when Barbican is integrated with Keystone.Read 4 Oct 2026 · docs.openstack.org
Components
The service includes barbican-api, barbican-worker, and barbican-keystone-listener components.Read 4 Oct 2026 · docs.openstack.org
Customization
Operators can develop custom plugins for secret storage, generation, and event handling; plugin support status can be stable, experimental, or out-of-tree.Read 4 Oct 2026 · docs.openstack.org
Deployment requirement
The installation documentation assumes a working OpenStack deployment.Read 4 Oct 2026 · docs.openstack.org
HSM support
The PKCS#11 crypto plugin interfaces with a Hardware Security Module, with master encryption and HMAC keys residing in the HSM.Read 4 Oct 2026 · docs.openstack.org
Keystone
The Keystone listener manages Barbican database representations of Keystone projects when those projects are deleted.Read 4 Oct 2026 · docs.openstack.org
Secret stores
A plugin architecture lets operators store secrets in software-based stores or hardware devices such as HSMs.Read 4 Oct 2026 · docs.openstack.org
Security tradeoff
The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so access to service nodes must be restricted carefully.Read 4 Oct 2026 · docs.openstack.org

Plans and prices

Open source Barbican Free No plan limits stated Read 4 Oct 2026 · docs.openstack.org

Every OpenStack Barbican plan and price →

Strong points and limits

Strong points

  • Free and licensed under Apache 2.0.
  • OpenStack-native REST API for secret management.
  • Plugin options include HSM support.
  • Custom plugins can support storage, generation, and event handling.

Limits

  • Default Simple Crypto key is stored in plaintext.
  • Container ACL settings do not propagate to secrets.
  • ACL functionality requires Keystone integration.
  • Installation assumes a working OpenStack deployment.

Who it suits

Barbican suits OpenStack operators who need to manage secrets through an API and configure software- or hardware-backed stores. Its installation documentation assumes an existing working OpenStack deployment.

Verdict

Barbican provides a plugin-based secret management service for OpenStack, including options for HSM-backed keys. Operators should account for the default key-storage behavior and the stated ACL limitations when planning a deployment.

Where Specifiction places it

Alternatives to OpenStack BarbicanAll alternatives →