OpenNebula vs OpenStack Barbican

OpenNebula is an open-source cloud and virtualization management platform for infrastructure across on-premises, public-cloud, and edge environments. Its control plane brings KVM virtual machines and Kubernetes clusters together, and it also supports LXC container virtualization. High-availability features include redundant control-plane components, hypervisor-node failover, and VM replication and recovery workflows across data centers. Management options include a web GUI, command-line tools, and REST, gRPC, and XML-RPC APIs. OpenNebula runs on major Linux distributions including RHEL, Ubuntu, Debian, and AlmaLinux. GPU scheduling with vGPU and MIG supports AI and HPC workloads. The maker lists integrations such as NVIDIA Spectrum-X, SUSE, NetApp, Veeam, and Everpure, as well as certified hosted-cloud providers. The Community Edition is free, while certain tested and certified enterprise releases are subscriber-only. Enterprise subscriptions include unlimited CPUs, cores, and VMs; Standard support is 9×5 and Premium support is 24×7 in CET and EST. Subscription pricing is by tailored proposal, with no price stated.

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.