ECS and Vault: Shhhhh I have a secret

#1

Post by kiyanwang » Mon, Nov 21, 2016, 7:39 AM UTC

ECS and Vault: Shhhhh I have a secret
kickstarter.com

Re: ECS and Vault: Shhhhh I have a secret

#2

Post by nodesocket » Mon, Nov 21, 2016, 7:51 AM UTC

Any idea if Kickstarter looked at secret store alternatives such as Square Keywhiz[1] or Sneaker[2]?

  [1] https://square.github.io/keywhiz/
  [2] https://github.com/codahale/sneaker

Re: ECS and Vault: Shhhhh I have a secret

#3

Post by flurdy » Mon, Nov 21, 2016, 10:21 AM UTC

I did not realise this was a tech blog by kickstarter themselves. I kept looking for where do I back this project. I thought maybe this was a new "back a howto or integration example" feature... Its early, my brain is not yet awake.

Re: ECS and Vault: Shhhhh I have a secret

#4

Post by koolba » Mon, Nov 21, 2016, 12:22 PM UTC

This will break badly if you have whitespace in your environment variable names or values:

    export $(envconsul -once -config="/envconsul-config.hcl" env | xargs)

What they really should do is add an "--as-exports" option that outputs lines of properly escaped "export FOO=" lines. That output could then be processed in a script via:

    envconsul --as-exports | source /dev/stdin

Re: ECS and Vault: Shhhhh I have a secret

#5

Post by otterley » Mon, Nov 21, 2016, 3:57 PM UTC

How are you garbage collecting the S3 objects?

Re: ECS and Vault: Shhhhh I have a secret

#6

Post by ktheory » Mon, Nov 28, 2016, 3:47 PM UTC

nodesocket wrote: post #2

Any idea if Kickstarter looked at secret store alternatives such as Square Keywhiz[1] or Sneaker[2]? [1] https://square.github.io/keywhiz/ [2] https://github.com/codahale/sneaker

(Kickstarter staff here.)

We did. Those are great projects.

Personally, I see Vault having a lot of community momentum behind it; and it can easily solve some complicated security infrastructure beyond storing secrets (the PKI, MySQL & ssh secret backends are particularly compelling).