HashiCorp Vault

HashiCorp Vault is the defining product of the secrets-management category: a centralized service that brokers, rotates, and encrypts secrets for applications and infrastructure. Its signature pattern is dynamic secrets, short-lived database and cloud credentials that are issued on demand and revoked automatically, so nothing long-lived sits in config files. Around that core sit a transit engine for encryption-as-a-service, a PKI engine that acts as a certificate authority, and a plugin ecosystem for auth methods and secret engines. A September 2026 snapshot showed roughly 36,300 GitHub stars, making it one of the most-starred infrastructure projects.

Vault is open-core. The Community Edition is free to self-host but runs under the Business Source License 1.1 since the license change, which creates procurement friction for some teams. Enterprise adds namespaces, replication, disaster recovery, and HSM auto-unseal at per-client pricing that gets expensive in Kubernetes. There is also HCP Vault Dedicated, a managed single-tenant cloud offering. HashiCorp was acquired by IBM in February 2025, which adds ownership-transition questions to enterprise evaluations. The honest trade-off is depth versus operational weight: Vault is a stateful clustered service that must be unsealed, backed up, and upgraded, so it is the right answer for multi-cloud platform teams with ops capacity and overkill for fifteen YAML files with API keys.

Run the Community Edition as a Docker container or a Raft-integrated storage cluster, initialize and unseal it, then configure auth methods (Kubernetes, cloud IAM, TLS certs) and secret engines. Kubernetes teams typically integrate via the sidecar injector, the CSI driver, or the Vault Secrets Operator.