- Home
- Key Management Software
- OpenStack Barbican
OpenStack Barbican
What it is
OpenStack Barbican is a key-management service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for provisioning and managing secrets. The service also includes barbican-worker and barbican-keystone-listener; the listener manages Barbican database records when Keystone projects are deleted. A plugin architecture connects Barbican to software-based stores or hardware such as HSMs. Documented options include KMIP, Dogtag, Vault, and PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can create custom plugins for secret storage, generation, and event handling, with support status varying between stable, experimental, or out-of-tree. The default Simple Crypto plugin keeps its single encryption key in plaintext in barbican.conf, so access to service nodes needs careful restriction. Container ACL settings do not carry over to associated secrets, and ACL functionality applies only with Keystone integration. Barbican is free under Apache 2.0, and its installation documentation assumes an existing, working OpenStack deployment.
For and against
For
- Provides an OpenStack-native REST API.
- Plugin architecture supports software stores and HSMs.
- PKCS#11 can keep master keys in an HSM.
- Operators can develop custom plugins.
Against
- Installation assumes a working OpenStack deployment.
- Default Simple Crypto key is stored in plaintext.
- Container ACL settings do not apply to associated secrets.
- ACL functionality requires Keystone integration.
The verdict
Barbican offers a plugin-based approach to managing secrets in OpenStack, including support for HSM-backed key storage. Operators should review its default key handling and ACL constraints as part of deployment planning.
Who it suits
Barbican suits OpenStack operators who need to provision and manage secrets through an API and configure software or hardware-backed stores. Teams should be prepared to deploy it within a working OpenStack environment.
Plans and prices
Open source Barbican
No plan limits stated
Read 4 Oct 2026 · docs.openstack.org
On the record
- ACL limitation
- Container ACL settings are not propagated to associated secrets, and ACL functionality applies only when Barbican is integrated with Keystone.docs.openstack.org · read 4 Oct 2026
- API
- The barbican-api service provides an OpenStack-native REST API for provisioning and managing secrets.docs.openstack.org · read 4 Oct 2026
- Components
- The service includes barbican-api, barbican-worker, and barbican-keystone-listener components.docs.openstack.org · read 4 Oct 2026
- Customization
- Operators can develop custom plugins for secret storage, generation, and event handling; plugin support status can be stable, experimental, or out-of-tree.docs.openstack.org · read 4 Oct 2026
- Deployment requirement
- The installation documentation assumes a working OpenStack deployment.docs.openstack.org · read 4 Oct 2026
- HSM support
- The PKCS#11 crypto plugin interfaces with a Hardware Security Module, with master encryption and HMAC keys residing in the HSM.docs.openstack.org · read 4 Oct 2026
- Integrations
- Documented secret-store plugins include KMIP, Dogtag, and Vault, alongside PKCS#11 crypto plugins.docs.openstack.org · read 4 Oct 2026
- Keystone
- The Keystone listener manages Barbican database representations of Keystone projects when those projects are deleted.docs.openstack.org · read 4 Oct 2026
- License
- The OpenStack project is provided under the Apache 2.0 license.docs.openstack.org · read 4 Oct 2026
- Purpose
- Barbican is the OpenStack Key Manager service for secure storage, provisioning, and management of secrets such as keys, certificates, passwords, and raw binary data.docs.openstack.org · read 4 Oct 2026
- Secret stores
- A plugin architecture lets operators store secrets in software-based stores or hardware devices such as HSMs.docs.openstack.org · read 4 Oct 2026
- Security tradeoff
- The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so access to service nodes must be restricted carefully.docs.openstack.org · read 4 Oct 2026
