Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla SOPS with KMS and Git is underrated (2019)

oteemo.com

Post reply on HN
Print view View original

21–30 of 36 posts

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#21

Post by tanseydavid »

lvh wrote: post #16
dhdsingfgg wrote: post #2

10 months ago, 62 days ago and then again today. You should find something else to share instead of vault. https://news.ycombinator.com/from?site=oteemo.com Note- I dont work for Hashicorp but have used many of their excellent products from time to time.

The submitters are different people. Are you suggesting they're sockpuppets?

I am thrilled that this excellent article showed up on HN today in spite of it perhaps having been posted before.

This is the first that I have seen the article and it directly addresses a knowledge gap for me that I have been eager to fill.

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#22

Post by kitotik »

tanseydavid wrote: post #20
kitotik wrote: post #5

Not to overreact, but this seems like a trashy hit piece. Vault checks all the boxes for the authors own “Ideal Secrets Management Solution Requirements“. If Vault’s only feature was its PKI, it would be underhyped in my opinion.

The article is thorough and informative and it seems to me that it is entirely incorrect to characterize it as "Hit Piece" -- there is simply too much, high-quality technical information in the article to reduce it to a "hit piece." To call it "trashy" makes me suspect you did not read all or much of the content.

I skimmed it this time, and read it one of the 2 previous times it was on HN.

There is some thoughtful technical information in the article.

I admit it is hard for me to recover from click baity titles, and that probably lead to my choice of words.

I guess I would rephrase my salty comment as - “this article would be better if it simply focused on the value of SOPS + KMS+ git for some use cases instead of characterizing Vault as ‘overhyped’.”

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#23

Post by narag »

busterarm wrote: post #19
lvh wrote: post #16

Earlier quoted context omitted.

The submitters are different people. Are you suggesting they're sockpuppets?

HN really needs functionality for searching previously-submitted URLs.

Mods are OK with re-submisions as far as it's interesting stuff and not too soon after the last time. They've told so much a number of times.

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#24

Post by busterarm »

narag wrote: post #23
busterarm wrote: post #19

Earlier quoted context omitted.

HN really needs functionality for searching previously-submitted URLs.

Mods are OK with re-submisions as far as it's interesting stuff and not too soon after the last time. They've told so much a number of times.

Right, that's why I said search and not a block. Two months ago isn't very long ago and it wasn't very interesting the other two times.

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#25

Post by weitzj »

mitchellh wrote: post #4

I'm one of the creators of Vault. I read this back when it was posted and I'd be happy to share my thoughts. I'll note its worth reading through to the last paragraph and into the comments, the title is a bit bait-y and the article does a better job than the title gives itself credit for. Broadly speaking, if you're looking at Vault to solve a specific problem X for a specific consumption type Y on a specific platfor…

Thanks for vault. Thievish why we use it.

Only for bootstrapping the TLS key of the vault servers we needed another tool.

Sure there is sops.

We opted for google/tink

This gives us asymmetric encryption with KMS for bootstrapping the vault AMIs on AWS.

We create Vault AMIs with Packer and put encrypted TLS keys inside the AMIs. This way we have immutable machine images, which can crash/restart using an Autoscaling group and we can attach all decryption processes to the instance role of the EC2 machines

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#26

Post by dharmab »

polskibus wrote: post #15
mitchellh wrote: post #4

I'm one of the creators of Vault. I read this back when it was posted and I'd be happy to share my thoughts. I'll note its worth reading through to the last paragraph and into the comments, the title is a bit bait-y and the article does a better job than the title gives itself credit for. Broadly speaking, if you're looking at Vault to solve a specific problem X for a specific consumption type Y on a specific platfor…

Would you mind comparing Vault to Keycloak? https://www.keycloak.org/ I need an equivalent to Windows' Active Directory in Linux world that ideally can also federate with/masquerade as AD. Can Vault be such thing?

Vault and Keycloak serve entirely separate use cases. Vault is for storing secrets (passwords, API keys, keypairs and the like).

If you can use public cloud, have you considered Azure Active Directory? We're a Linux shop using it very successfully for on-prem and cloud systems.

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#27

Post by polskibus »

dharmab wrote: post #26
polskibus wrote: post #15

Earlier quoted context omitted.

Would you mind comparing Vault to Keycloak? https://www.keycloak.org/ I need an equivalent to Windows' Active Directory in Linux world that ideally can also federate with/masquerade as AD. Can Vault be such thing?

Vault and Keycloak serve entirely separate use cases. Vault is for storing secrets (passwords, API keys, keypairs and the like). If you can use public cloud, have you considered Azure Active Directory? We're a Linux shop using it very successfully for on-prem and cloud systems.

I need a self sufficient component, that can be deployed on prem alongside other components, without public cloud dependency.

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#28

Post by jsiepkes »

polskibus wrote: post #15
mitchellh wrote: post #4

I'm one of the creators of Vault. I read this back when it was posted and I'd be happy to share my thoughts. I'll note its worth reading through to the last paragraph and into the comments, the title is a bit bait-y and the article does a better job than the title gives itself credit for. Broadly speaking, if you're looking at Vault to solve a specific problem X for a specific consumption type Y on a specific platfor…

Would you mind comparing Vault to Keycloak? https://www.keycloak.org/ I need an equivalent to Windows' Active Directory in Linux world that ideally can also federate with/masquerade as AD. Can Vault be such thing?

> I need an equivalent to Windows' Active Directory in Linux world that ideally can also federate with/masquerade as AD. Can Vault be such thing?

Vault is not such a thing.

AD is basically LDAP + Kerberos. Neither Vault nor Keycloak can fill that role. You would need Samba 4 setup as a domain controller [1] for that.

If you need AD but for Linux desktops you could take a look at FreeIPA [2].

If your feeling brave you can combine an LDAP server (like Wren:DS, 389 or OpenLDAP) with a Kerberos implementation like MIT Kerberos and create an AD like experience yourself. Though I would not recommend that.

[1] https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Acti...

[2] https://www.freeipa.org/

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#29

Post by nisa »

polskibus wrote: post #27
dharmab wrote: post #26

Earlier quoted context omitted.

Vault and Keycloak serve entirely separate use cases. Vault is for storing secrets (passwords, API keys, keypairs and the like). If you can use public cloud, have you considered Azure Active Directory? We're a Linux shop using it very successfully for on-prem and cloud systems.

I need a self sufficient component, that can be deployed on prem alongside other components, without public cloud dependency.

keycloak is pretty nice for that. You can just drop some docker-compose somewhere (or k8s) or plain wildfly/tomcat and you have saml idp + oauth2 (openid connect) out of the box including ui and self-service for users - it's also completly themeable (that's what I'm doing at the moment for a project)...

you don't even need a ldap/ad in the background but you can connect to one.

however it's strictly for authentication and authorization - basically users + roles

vault is different usecase but can probably be connected.

Re: Mozilla SOPS with KMS and Git is underrated (2019)

#30

Post by wolf4earth »

atonse wrote: post #9

Anyone here used Vault to secure a Phoenix application? In particular, the idea that a short lived database credential can get auto-refreshed and then notify the Repo's supervisor to restart the repo with new credentials? That's how I'd probably do it but I'd rather not reinvent the wheel if someone's already done it.

At the end of the day, what's the difference between restarting the app because you updated an environment variable, or restarting the repo?

In both cases you might have short service interruptions. So why not simply restart the app which is definitely more technology agnostic.

Post reply on HN