Google Compute Engine vs OpenStack Barbican

Google Compute Engine is an infrastructure-as-a-service product for running self-managed virtual machines on Google infrastructure. Choose a predefined machine type or configure a custom VM with 1 to 96 vCPUs and up to 8.0 GB of memory per core. Linux and Windows VMs are supported, with images including Debian, Ubuntu, FreeBSD, and Windows Server. Storage options include Persistent Disk and Local SSD. Managed instance groups can add VMs for peak load and replace underperforming instances; live migration can move a VM to another host in the same zone when its host goes down. Confidential VMs encrypt data in use, while Shielded VMs defend against rootkits and bootkits. The service integrates with Cloud Storage, App Engine, and BigQuery, and resources can be controlled through a REST-based API. Its free tier is free, within monthly limits and eligible US regions. Pay-as-you-go pricing is usage-based, with VM resources billed after a one-minute minimum in one-second increments.

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.