11–20 of 36 posts
In my case the secrets are stored in a sops-encrypted JSON file in the repository. Sops encrypts the secrets but keeps the JSON structure so changes to a specific secret can be tracked in git with a oneline change instead of a binary blob diff of the full file which is very nice.
No matter how you manage your secrets, one of the most important factors is how often you rotate your secrets. If you can't transition to fully dynamic just-in-time secret provisioning that Vault can provide for certain backends (including AD, OpenLDAP, PKI certs, various database engines, Consul, and more), then you still ought to be rotating your secrets on a regular basis. And in that case, a tool like Vault (or AWS Secrets Manager or GCP Secret Manager) is going to be a lot easier to build a rotation framework on top of than a git repo with secrets encrypted in place.
If you're thinking of HashiCorp Vault as a platform that is solely there for secure storage of static secrets (i.e. basically a secure key/value store), then you probably would think it is over-hyped. The power of Vault is in the integrations and the unification of authorization policies across those different integrations. "I need a way to allow my different AWS accounts to issue TLS certificates within particular n…
It also has to be said that KMS will get expensive quickly too. Though it is probably fair to say that a three node vault installation with dynodb backend won't be so cheap it'll be rock-solid and I think it could be documented within an hour - for a develop to use it at least.
Edit: I'd never heard of SOPS, apart from the many open issues and pull-requests making it look a little swamped, it seems like a nice tool. Especially given that it can work with GPG-keys.
Exampme, it can authenticate using K8S JWT, or AWS IAM. Using K8S JWT, the process of generation token is gone, you use the token from k8s. Send it to Vault.
If you just look for something like a key-value store for env var and authorized using simple username/password pair then KMS or any key-value store with a HTTP on top of it will work.
I'm one of the creators of Vault. I read this back when it was posted and I'd be happy to share my thoughts. I'll note its worth reading through to the last paragraph and into the comments, the title is a bit bait-y and the article does a better job than the title gives itself credit for. Broadly speaking, if you're looking at Vault to solve a specific problem X for a specific consumption type Y on a specific platfor…
I need an equivalent to Windows' Active Directory in Linux world that ideally can also federate with/masquerade as AD. Can Vault be such thing?
10 months ago, 62 days ago and then again today. You should find something else to share instead of vault. https://news.ycombinator.com/from?site=oteemo.com Note- I dont work for Hashicorp but have used many of their excellent products from time to time.
10 months ago, 62 days ago and then again today. You should find something else to share instead of vault. https://news.ycombinator.com/from?site=oteemo.com Note- I dont work for Hashicorp but have used many of their excellent products from time to time.
The submitters are different people. Are you suggesting they're sockpuppets?
Not to overreact, but this seems like a trashy hit piece. Vault checks all the boxes for the authors own “Ideal Secrets Management Solution Requirements“. If Vault’s only feature was its PKI, it would be underhyped in my opinion.
To call it "trashy" makes me suspect you did not read all or much of the content.