Google Cloud Secret Manager is Google's managed secrets service, billed per active secret version, access operation and rotation notification. Pages here cover replacing it with self-hosted OpenBao or Infisical.
Comparing Google Cloud Secret Manager with self-hosted OpenBao: IAM-based access versus OpenBao policies and auth methods including GCP, rotation you build yourself versus dynamic secrets, regional data location, quotas, and the operating effort of running OpenBao.
Comparing Secret Manager with self-hosted Infisical for application teams: projects and environments, secret syncs back to GCP, built-in rotation and dynamic secrets, Kubernetes operator, GCP machine identity auth, and the enterprise license for SSO.
Moving secrets from Secret Manager to OpenBao: reading versions within access quotas, mapping secret names, labels and IAM bindings to OpenBao paths and policies, switching workloads to the GCP auth method, and replacing Pub/Sub rotation functions.
Cost by component: active secret versions per replica location, access operations and rotation notifications at Google's published prices, against OpenBao servers, storage, setup and operations, and why replication settings change the Secret Manager bill.
Secret Manager only sends Pub/Sub notifications; the rotation code is yours. This page compares that with OpenBao's database secrets engine, which issues short-lived credentials or rotates static accounts itself, and with Infisical's rotation features.
Getting secrets out of Secret Manager before leaving GCP: listing secrets and versions, accessing payloads within per-project quotas, keeping version history and labels, handling CMEK-protected secrets, and deleting versions once the new store is live.
For organizations running workloads beyond GCP: one OpenBao or Infisical service with GCP, AWS, Azure and Kubernetes auth instead of separate cloud secret stores, and when keeping Secret Manager for GCP-native services still makes sense.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.