HCP Vault Secrets was shut down a few months ago, and the suggested replacement, HCP Vault Dedicated, works quite differently. Many teams originally chose HVS because they didn't want to manage Vault policies and authentication themselves. Dedicated requires that work, and the pricing also changes substantially: you pay for the cluster plus a monthly fee for each application or CI runner that connects. One estimate put a small production setup with 50 clients at roughly $4,800 per month, though it's unclear how typical that is. For teams that were using HVS, what did you migrate to, and how difficult was it to update your integrations?
4 Answers
The part I’d plan around is CI authentication, not just secret storage. Inventory every pipeline and internal tool that reads secrets, move runners toward short-lived OIDC credentials, and consider a temporary dual-read period. That catches forgotten jobs before they start breaking deployments. After the cutover, rotate the secrets again—migration exports can leave copies sitting in plaintext files during the process.
CyberArk Conjur was another destination, particularly for teams already invested in that ecosystem. It can handle the access-control side well, but the workflow may feel less convenient: some administrative tasks are primarily CLI-driven, including creating secrets. I’d evaluate the operator experience before choosing it solely for feature compatibility.
Infisical was the easiest option for us when the priority was getting migrated quickly with minimal setup. The interface and integrations made the initial move fairly painless, and the cost was substantially lower than the Dedicated estimate we were looking at. CI/CD still needs careful testing, but the day-to-day setup is much less involved.
A lot of people seem to have gone with OpenBao, especially if they wanted to stay close to the Vault model without moving to Dedicated. The tradeoff is that HVS hid much of the operational work, so switching to OpenBao means taking responsibility for deployment, authentication, policies, upgrades, and backups. It’s conceptually familiar, but not necessarily a drop-in migration.
That integration work was our biggest headache too. GitHub Actions, Terraform, and Kubernetes each needed slightly different authentication and configuration changes, so testing only the main application wasn’t enough.