BeyondTrust DevOps Secrets Safe v20.2: What’s New in Secrets Management

This article is based on the BeyondTrust product announcement for DevOps Secrets Safe v20.2, originally published April 2020. Source: beyondtrust.com.

Overview: DevOps Secrets Safe v20.2

BeyondTrust released DevOps Secrets Safe v20.2, adding capabilities to its centralized secrets management platform aimed at enterprise DevOps teams. DevOps Secrets Safe is designed to create, store, access, and audit secrets—passwords, API keys, certificates, and other credentials—used across CI/CD pipelines, applications, automated processes, and non-human identities.

The solution is built on Kubernetes as its deployment platform, giving organizations the flexibility to run it on a preferred cloud provider or on-premises. This architecture is intended to help enterprises meet security and compliance requirements without sacrificing the speed and scale that DevOps workflows demand.

Version 20.2 ships four notable additions: policy-based secret generation, a native Azure DevOps integration, Microsoft SQL Server (MSSQL) backend support, and bash auto-complete for the CLI. The sections below explain each feature in practical terms.

Policy-Based Secret Generation

One of the most persistent security risks in automated pipelines is static credentials—hardcoded passwords or API keys baked into source code, configuration files, or container images. When infrastructure is provisioned dynamically as part of a build or deployment pipeline, new service accounts and application identities are created, and those accounts need initial credentials.

DevOps Secrets Safe v20.2 can now generate these credentials automatically, applying organization-defined policies to enforce complexity, length, character-set rules, and rotation schedules. Because the generated secret is managed inside DevOps Secrets Safe from the moment of creation, it is never committed to source control or embedded in a build artifact. The pipeline retrieves the secret at runtime through the API or CLI instead.

Key benefits of policy-based secret generation:

• Eliminates the need to manually create and distribute initial credentials for new service accounts.
• Enforces consistent password policies across all automatically provisioned identities.
• Keeps secrets dynamic and auditable rather than static and invisible.
• Reduces the blast radius of a compromised credential because each account gets a unique secret.

Azure DevOps Marketplace Integration

Adoption of a secrets manager rises and falls with how frictionless it is to use from within existing tooling. BeyondTrust has published a native DevOps Secrets Safe extension to the Azure DevOps Marketplace, available as a pipeline task.

Teams using Azure Pipelines can add the task to any build or release stage to retrieve a secret from DevOps Secrets Safe at runtime. The secret is injected as a pipeline variable and is never stored in Azure DevOps itself. This pattern keeps credentials out of pipeline YAML files and variable groups while still making them available to build steps, scripts, and deployment jobs.

This extends BeyondTrust’s list of native CI/CD integrations. Teams already using Azure DevOps as their primary delivery platform can now onboard to DevOps Secrets Safe without writing custom API wrappers or managing secrets retrieval scripts.

Microsoft SQL Server Backend Support

DevOps Secrets Safe stores secrets and configuration data in a backend relational database. Previous releases supported specific database backends; v20.2 adds Microsoft SQL Server (MSSQL) to that list.

For enterprises that have standardized on SQL Server and already operate it at scale with high-availability configurations, replication, and DBA tooling, this avoids introducing an additional database technology solely to support secrets management. Organizations can point DevOps Secrets Safe at an existing MSSQL instance during deployment and inherit their current database’s performance, backup, and disaster-recovery posture.

The vendor-agnostic database strategy also matters for regulated industries where every new infrastructure component requires a procurement, security review, and approval cycle. Using an already-approved database shortens that path significantly.

CLI Bash Auto-Complete

DevOps Secrets Safe exposes a REST API and ships a CLI that wraps that API for administrative tasks—creating secrets, managing policies, retrieving credentials, reviewing audit logs, and so on. In v20.2, the CLI gains bash-completion support.

Bash completion allows operators to press Tab to auto-complete commands, subcommands, flags, and in some cases values, rather than consulting documentation for exact syntax. For a CLI with many subcommands and options, this reduces errors and speeds up day-to-day administration tasks.

This is a small quality-of-life improvement, but it matters in practice: operators who find a CLI ergonomic are more likely to use it consistently rather than resorting to workarounds that bypass audit trails.

Why Secrets Management Matters in CI/CD Pipelines

Credentials and secrets are among the most common attack vectors in software supply chain compromises. Hardcoded API keys checked into version control, shared service account passwords stored in pipeline variables, and long-lived certificates that never rotate all create exploitable exposure.

A dedicated secrets management solution like DevOps Secrets Safe addresses these risks by centralizing secret storage with encryption at rest, enforcing access controls based on identity and role, generating audit trails for every secret access event, and enabling rotation without requiring application redeployment.

The Kubernetes-native architecture means secrets management itself can be deployed, scaled, and managed using the same infrastructure-as-code and GitOps practices the rest of the DevOps environment already relies on.

Summary of v20.2 Changes

For full release notes and documentation, refer to the BeyondTrust website. Organizations evaluating secrets management solutions for Kubernetes-based DevOps environments should also compare BeyondTrust DevOps Secrets Safe against HashiCorp Vault, CyberArk Conjur, and AWS Secrets Manager to determine the best fit for their stack and compliance requirements.