VMware Secrets Manager review
A focused self-hosted option for Kubernetes workloads needing identity-aware secret delivery.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
VMware Secrets Manager (VSecM) is an open-source, self-hosted secrets store for teams operating Kubernetes clusters and cloud-native workloads. It stores secrets in VSecM Safe and uses SPIFFE-compatible identities to authenticate components and workloads. Secret delivery can happen through a sidecar, SDK, init container, or generated Kubernetes Secret objects, giving teams options for both newer applications and legacy workloads. REST access, a CLI, and an official Go SDK support administration and application retrieval.
Its strongest fit is a Kubernetes-centered platform and identity model. Integrations with Kubernetes, SPIFFE, SPIRE, and Helm align it with clusters that already use workload identity and Helm-based deployment. Sidecar delivery and runtime secret updates can help applications receive changed values without a workload restart, while pattern-based random secret generation supports common generated-secret workflows. Encrypted-at-rest storage and encrypted backups address protection of stored material, and Sentinel logging configuration provides audit logging. These capabilities make VSecM more focused than a general-purpose secrets product: it is designed around Kubernetes-native storage, dispatch, and identity rather than broad platform coverage.
The published project status places VSecM in active maintenance mode, with new feature development deferred while SPIKE reaches v1.0. That matters for teams evaluating long-term feature expansion. The product is also narrowly self-hosted and Kubernetes-focused, with no verified rotation, dynamic secrets, or CI/CD injection. Choose VMware Secrets Manager when Kubernetes workload identity, sidecar delivery, runtime updates, and self-managed operation are central requirements. Consider an alternative when the priority is a broader secrets lifecycle, dynamic credentials, automated rotation, or CI/CD-oriented injection.
VMware Secrets Manager pros and cons
- Where it wins
- SPIFFE/SPIRE identity supports workload authentication and communication
- Sidecar delivery, SDK access, and Kubernetes Secret generation
- Encrypted backups, runtime updates, generation, and audit logging
- Where it doesn't
- Requires a self-hosted Kubernetes deployment
- Narrower focus than platforms with rotation or dynamic secrets
- New feature development is deferred during active maintenance mode
VMware Secrets Manager fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update