VMware Secrets Manager

Spec sheet

Purpose

VMware Secrets Manager is a Kubernetes-native key-value store for securely storing and dispatching secrets to cloud-native workloads.Read 11 Oct 2026 · vsecm.com

Security

Plaintext secrets are held in memory, while data VSecM saves to disk is encrypted.Read 11 Oct 2026 · vsecm.com

Support

The project directs users to its Slack workspace for questions and community help, and to GitHub Issues for bug reports, feature requests, or questions.Read 11 Oct 2026 · vsecm.com

License

The VSecM code is distributed under the BSD 2-Clause License.Read 5 Oct 2026 · vsecm.com

Compatibility

VSecM is designed to run on Kubernetes only and is not intended to run outside Kubernetes or as a standalone binary.Read 11 Oct 2026 · vsecm.com

Data protection

Sensitive data is stored in memory, while data saved to disk and backups are encrypted.Read 5 Oct 2026 · vsecm.com

Encryption

The production documentation says VSecM Safe encrypts secrets using age, or AES-256-GCM in FIPS-compliant environments.Read 11 Oct 2026 · vsecm.com

Federation

VSecM supports federation of secrets across namespaces and clusters.Read 5 Oct 2026 · vsecm.com

FIPS mode

FIPS mode is off by default and can be enabled by setting VSECM_SAFE_FIPS_COMPLIANT to true.Read 11 Oct 2026 · vsecm.com

Identity

VSecM uses SPIFFE as its identity control plane for workload authentication.Read 5 Oct 2026 · vsecm.com

Identity integration

VSecM uses SPIRE as its default identity control plane, and SPIFFE-compatible identity control planes can also be used.Read 11 Oct 2026 · vsecm.com

Installation

VSecM installs into a Kubernetes cluster using Helm charts or Makefile targets; the documented prerequisites include Helm, kubectl, a running cluster, and make.Read 5 Oct 2026 · vsecm.com

Kubernetes requirement

VSecM is designed to run only on Kubernetes, not as a standalone binary or outside Kubernetes.Read 5 Oct 2026 · vsecm.com

Legacy workloads

VSecM can create Kubernetes Secret objects for workloads that cannot use its SDK or Sidecar integration.Read 11 Oct 2026 · vsecm.com

No admin token

VSecM requires no admin token for operation, though users may provide a root token and then manually unlock after a crash.Read 5 Oct 2026 · vsecm.com

Operational limit

VSecM Safe keeps plaintext secrets in memory, so the quantity of secrets is limited by the memory allocated to it.Read 11 Oct 2026 · vsecm.com

Project status

The project says it is in active maintenance mode, prioritizing security fixes while deferring new feature development until SPIKE reaches v1.0.Read 11 Oct 2026 · vsecm.com

Resilience

Workloads can continue using existing secrets when a VSecM component fails, and the component can recover state from an encrypted backup.Read 5 Oct 2026 · vsecm.com

Resource limits

The project notes that in-memory storage limits capacity and says a couple of gigabytes of RAM can hold many plain-text secrets.Read 5 Oct 2026 · vsecm.com

Rotation

The VSecM SDK can retrieve rotated secrets without requiring the application to restart or be evicted.Read 11 Oct 2026 · vsecm.com

Secret delivery

Secrets can be delivered to workloads with the VSecM SDK, Sidecar, or Init Container, or persisted as Kubernetes Secret objects.Read 11 Oct 2026 · vsecm.com

Secret history

VSecM records creation and update timestamps and keeps version history for secrets.Read 5 Oct 2026 · vsecm.com

Secretless mode

If operators opt out of Kubernetes Secrets for root-key protection, they must manually provide the root key again after VSecM Safe restarts or is evicted, crashes, or rescheduled.Read 11 Oct 2026 · vsecm.com

Security response

The stated target is to fix confirmed medium-or-higher severity vulnerabilities within 60 days and respond initially to vulnerability reports within 14 days.Read 5 Oct 2026 · vsecm.com

Transformations

VSecM supports GoLang transformations on secrets and interpolation of stored secrets onto Kubernetes Secrets.Read 5 Oct 2026 · vsecm.com

Plans and prices

Every VMware Secrets Manager plan and price →

Where Specifiction places it

• Secrets Management Tools#15 of 468.0