Sealed Secrets vs HashiCorp Vault
Sealed Secrets
Sealed Secrets is a Kubernetes controller from Bitnami that lets you store encrypted secrets directly in Git. You use the kubeseal CLI to encrypt a regular Kubernetes Secret into a SealedSecret custom resource, which only the controller running in your cluster can decrypt. This makes secret material safe to commit, review, and diff in version control without a separate secrets manager.
Pros
- No external secrets backend needed; just Git plus cluster
- Perfect fit for pure GitOps workflows
- Simple mental model: encrypt once, commit, done
- Backed by Bitnami (VMware) with stable release cadence
Things to check
- Key rotation requires re-sealing every secret
- Lose the cluster key, lose every sealed secret
- No per-key RBAC; anyone who can create a SealedSecret can decrypt it once applied
- No rotation or lifecycle features like a real secrets manager
Pricing: Free (open source)
HashiCorp Vault
HashiCorp Vault is a widely adopted open-source secrets management tool. It provides a unified interface for managing secrets, encrypting data in transit, and controlling access to sensitive information across distributed infrastructure. Vault supports dynamic secrets, leasing, and revocation.
Pros
- Massive community and ecosystem
- Highly extensible with plugins
- Strong enterprise features
- Multi-cloud and hybrid support
- Free open-source tier
Things to check
- Steep learning curve
- Complex to operate at scale
- Requires dedicated infrastructure
- Enterprise features require paid license
Pricing: Free self-managed Community edition (Business Source License, not true OSS); HCP Vault Dedicated managed cloud from $0.03/hr (about $22/mo) Development tier (HCP rates as of 2022; tiers have since been renamed, verify current pricing), production tiers from about $1.58/cluster-hr plus per-client fees; Vault Enterprise self-managed license is quote-only (contact sales).