- Home
- Secrets Management Tools
- VMware Secrets Manager
VMware Secrets Manager
What it is
VMware Secrets Manager (VSecM) is a free, open-source store for configuration secrets that dispatches them to workloads. It is designed exclusively for Kubernetes, using SPIFFE-compatible identity controls, with SPIRE as the default. Secrets can be delivered through a sidecar, init container, SDK, or Kubernetes Secret, and can be updated at runtime without rebooting workloads. VSecM keeps timestamps and version history, supports GoLang transformations and secret interpolation, and can federate secrets across namespaces and clusters. Plaintext secrets remain in memory; saved data and backups are encrypted. Production documentation describes age encryption or AES-256-GCM in FIPS-compliant environments, while FIPS mode is off by default. Installation uses Helm charts or Makefile targets and requires Helm, kubectl, a running cluster, and make. Its memory-based storage limits capacity. The project is in active maintenance while development focuses on SPIKE v1.0, with new feature implementations deferred. VSecM is distributed under the BSD 2-Clause License and is available as API and self-hosted Linux software.
For and against
For
- Free and open source under BSD 2-Clause
- Secret updates can avoid workload restarts
- Supports federation across namespaces and clusters
- Disk data and backups are encrypted
Against
- Runs only on Kubernetes
- In-memory storage limits capacity
- New feature implementations are deferred during active maintenance
The verdict
VSecM offers a Kubernetes-focused, open-source approach to workload secrets, with multiple delivery methods and runtime updates. Its Kubernetes requirement, memory-based capacity, and current maintenance focus are important constraints.
Who it suits
VSecM suits teams operating Kubernetes workloads that need to store and deliver secrets through supported integrations. It is not intended for standalone use or deployment outside Kubernetes.
Plans and prices
Free and open source
BSD 2-Clause licensed · designed to run on Kubernetes
Read 11 Oct 2026 · vsecm.com
On the record
- Compatibility
- VSecM is designed to run on Kubernetes only and is not intended to run outside Kubernetes or as a standalone binary.vsecm.com · read 11 Oct 2026
- Data protection
- Sensitive data is stored in memory, while data saved to disk and backups are encrypted.vsecm.com · read 5 Oct 2026
- Encryption
- The production documentation says VSecM Safe encrypts secrets using age, or AES-256-GCM in FIPS-compliant environments.vsecm.com · read 11 Oct 2026
- Federation
- VSecM supports federation of secrets across namespaces and clusters.vsecm.com · read 5 Oct 2026
- FIPS mode
- FIPS mode is off by default and can be enabled by setting VSECM_SAFE_FIPS_COMPLIANT to true.vsecm.com · read 11 Oct 2026
- Identity
- VSecM uses SPIFFE as its identity control plane for workload authentication.vsecm.com · read 5 Oct 2026
- Identity integration
- VSecM uses SPIRE as its default identity control plane, and SPIFFE-compatible identity control planes can also be used.vsecm.com · read 11 Oct 2026
- Installation
- VSecM installs into a Kubernetes cluster using Helm charts or Makefile targets; the documented prerequisites include Helm, kubectl, a running cluster, and make.vsecm.com · read 5 Oct 2026
- Kubernetes requirement
- VSecM is designed to run only on Kubernetes, not as a standalone binary or outside Kubernetes.vsecm.com · read 5 Oct 2026
- Legacy workloads
- VSecM can create Kubernetes Secret objects for workloads that cannot use its SDK or Sidecar integration.vsecm.com · read 11 Oct 2026
- License
- The VSecM code is distributed under the BSD 2-Clause License.vsecm.com · read 5 Oct 2026
- No admin token
- VSecM requires no admin token for operation, though users may provide a root token and then manually unlock after a crash.vsecm.com · read 5 Oct 2026
- Operational limit
- VSecM Safe keeps plaintext secrets in memory, so the quantity of secrets is limited by the memory allocated to it.vsecm.com · read 11 Oct 2026
- Project status
- The project says it is in active maintenance mode, prioritizing security fixes while deferring new feature development until SPIKE reaches v1.0.vsecm.com · read 11 Oct 2026
- Purpose
- VMware Secrets Manager is a Kubernetes-native key-value store for securely storing and dispatching secrets to cloud-native workloads.vsecm.com · read 11 Oct 2026
- Resilience
- Workloads can continue using existing secrets when a VSecM component fails, and the component can recover state from an encrypted backup.vsecm.com · read 5 Oct 2026
- Resource limits
- The project notes that in-memory storage limits capacity and says a couple of gigabytes of RAM can hold many plain-text secrets.vsecm.com · read 5 Oct 2026
- Rotation
- The VSecM SDK can retrieve rotated secrets without requiring the application to restart or be evicted.vsecm.com · read 11 Oct 2026
