Azure Key Vault vs OpenStack Barbican

Azure Key Vault is a cloud service accessed through the web for managing keys, secrets, and certificates. Its Standard plan lists software-protected keys, secrets operations, and certificate operations. Premium lists HSM-protected keys with the same secrets and certificate operations. The service includes key audit logs, audit logs, and secret rotation. It can inject secrets into CI/CD workflows and integrates with Kubernetes. The main stated distinction between plans is key protection: software protection in Standard versus HSM protection in Premium. Its cloud deployment model suits teams that need web-based management of credentials and cryptographic material, including delivery into deployment pipelines. The listed capabilities also provide operational visibility through logging and support recurring secret rotation.

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.