Conjur Open Source

Conjur Open Source is an open-source secrets store and role-based access control (RBAC) engine for managing secrets and application identity. A server holds secrets and access policy, applications and automation tools retrieve secrets through a REST web service, and integrations connect it to Kubernetes, CI/CD, and configuration-management tools. It is maintained by CyberArk, and its commercial counterpart is CyberArk Secrets Manager, Self-Hosted, which was formerly named Conjur Enterprise.

Key Capabilities

• Policy-based access control: Access is defined in a policy language called Machine Authorization Markup Language (MAML), a YAML-based syntax for roles, resources, and permissions. Policy is loaded through the REST API.
• Secrets storage: The server encrypts secrets using AES-256-GCM through its Slosilo library and signs tokens with a 2048-bit RSA key stored encrypted in the database. The server requires a Base64 data key at startup, and the project warns that losing it makes all encrypted data unrecoverable.
• Authenticators: Workloads authenticate through built-in and custom authenticators. The vendor lists authenticators for Kubernetes, OpenShift, AWS IAM, OpenID Connect (OIDC), and JSON Web Tokens (JWT).
• Rotation and dynamic secrets: Built-in rotators rotate variables on a schedule. Release 1.22.0 added an Issuers API and data model for dynamic secrets, which retrieves secrets through a configured ephemeral secrets engine.
• Host factory: Host factory tokens create hosts on demand for automated provisioning.
• Multi-tenancy: One server can run multiple separate accounts in the same database.
• Audit: The server records audit events for actions such as role and resource access.
• Clients: A command-line interface (CLI) and client libraries for .NET, Go, Java, Python 3, and Ruby, released under Apache License 2.0.
• Integrations: The project lists Kubernetes (an authenticator client and a secrets provider for Kubernetes), Cloud Foundry, Ansible, Jenkins, Puppet, Terraform, Secretless Broker, and Summon with providers for AWS Secrets Manager, S3, Chef, and the keyring.
• Migration: conjurctl export writes an encrypted archive that can be imported into CyberArk Secrets Manager, Self-Hosted.

Audience & Use Cases

• Audience: DevOps engineers, developers, and security teams that run their own secrets infrastructure. The sources name no roles, so this is inferred from the integrations.
• Use Case: Delivering secrets to applications and containers in Kubernetes and Cloud Foundry without embedding them in code or images.
• Use Case: Supplying credentials to CI/CD pipelines, Ansible playbooks, and Terraform runs.
• Use Case: Authenticating workloads by platform identity, such as AWS IAM roles or Kubernetes service accounts.
• Use Case: Running a self-hosted secrets store with a path to the commercial product.

Technical Specifications

• License: GNU Lesser General Public License v3.0 for the server, Apache License 2.0 for API clients and other extensions. CyberArk also offers commercial licenses.
• Runtime: Docker container or containers, with PostgreSQL 15 as the backing data store. The server creates and updates its database schema at startup.
• Deployment: Docker images, Docker Compose, a Helm chart for Kubernetes, and a CloudFormation template.
• Version: The latest changelog entry I read is 1.27.1, dated July 8, 2026.
• Support: Community support through the CyberArk Commons forum and GitHub issues. I found no service level agreement, support tiers, or end-of-life dates.

Lineage and Commercial Counterpart

Conjur Open Source was developed by CyberArk Software, which Palo Alto Networks acquired in a transaction it announced as complete on February 11, 2026. The changelog's 1.24.0 entry records that Conjur Enterprise was renamed Secrets Manager, and the project's README points users to migrate to CyberArk Secrets Manager, Self-Hosted. Palo Alto Networks now sells its secrets management under the Idira brand, and the conjur.org website redirects to the Idira Secrets Manager page, which does not mention the open-source project. I found no statement about the project's future, though its repository was active in mid-2026, and I could not verify that the commercial product shares code with the open-source server.