HashiCorp Vault replaces CyberArk and Doppler for zero-trust teams

Vault 2.0 and the identity-based security model

Vault 2.0 establishes the IBM versioning and support model following the recent acquisition. This versioning change follows the 2023 license change from the Mozilla Public License to the Business Source License. The release introduces Workload Identity Federation to authenticate with AWS, Azure, and GCP using OIDC tokens. This feature reduces the risk of credential leakage during the synchronization process. Vault also provides SPIFFE JWT-SVID support to enable secure workload participation in identity meshes. Version 1.21 adds native SPIFFE authentication for non-human workloads and expands the granular secret recovery model. Operators can now recover specific paths, such as database static roles or SSH config CA, without restoring an entire cluster from a snapshot. Vault 1.21 also adds KV v2 secret attribution, which exposes a created_by field to version metadata so developers can identify who modified a secret. Vault Enterprise 1.21 includes a CSI driver that mounts secrets directly into pods to bypass etcd. The release adds SCEP support to the PKI secrets engine to facilitate certificate management for routers, firewalls, and IoT hardware. Vault 1.21 also includes MFA TOTP self-enrollment, which allows users to generate a QR code during the authentication process without administrator intervention. Modifications to the internal storage engine improve performance for high-volume operations, specifically for real-time encryption and authentication tasks at the enterprise scale. Will the community-driven OpenBao fork eventually overtake Vault in adoption?

Kubernetes encryption and the operational cost

The public beta of Vault Kubernetes key management lets Kubernetes clusters use Vault Enterprise as a KMS provider. The plugin offloads envelope encryption to Vault by using the transit secrets engine to protect key encryption keys. Kubernetes still generates data encryption keys to maintain throughput for the API server. This plugin serves enterprise Kubernetes platforms like Red Hat OpenShift and multi-cluster production estates that require separation of duties. You know the operational burden of managing Raft consensus and unsealing procedures in a production environment. The KMS deployment requires the ability to modify the kube-apiserver manifest and the KubernetesEncryptionConfig. This requirement rules out most fully managed control planes. The Vault Secrets Operator CSI driver fetches secrets from Vault and mounts them as individual files at a configured path, so that secrets live only for the lifecycle of the pod and never persist in the cluster via etcd. The Vault 2.x releases also include native AI agent support to secure the stochastic behaviors of AI agent workflows.

Comparison of secrets management tools

CyberArk focuses on human admin control while Vault manages application secrets. CyberArk Conjur uses identity-based billing where the price scales based on the number of identities that request secrets. Organizations often pay for professional services that cost 20% to 40% of the first-year license cost. Self-hosted deployments also require annual maintenance of 17% to 22% of the license cost. CyberArk’s identity-based model means ephemeral workloads can quickly inflate license costs. CyberArk Conjur OSS lacks a web dashboard UI and native integration with CyberArk’s core PAM Vault. Doppler targets application developers by syncing environment variables into CI/CD pipelines and cloud providers. The Doppler Team plan starts at $12 per user per month and includes unlimited projects and environments. Doppler syncs secrets into Kubernetes, AWS, GitHub Actions, and Heroku. Doppler provides a developer-friendly CLI, and the doppler run command injects secrets directly into a process. AWS Secrets Manager manages credentials within the AWS ecosystem for $0.40 per secret per month plus $0.05 per 10,000 API calls.