How do I know I can trust this?
Vault – A tool for managing secrets
21–30 of 112 posts
Re: Vault – A tool for managing secrets
#22What are some of the existing tools/solutions which people use for managing secrets in a production environment?
Re: Vault – A tool for managing secrets
#23[deleted]
(EDIT: I appear to be replying to a edited comment that was mentioning a possible naming confusion with ansible vault, I'll keep the post here even though the original is different now) re: naming (and disclaimer): I wrote Ansible and designed Ansible's vault (and no longer work on Ansible), but to be clear, Ansible's vault is a nicer CLI (IMHO) around an idea that Chef users were already used to: encrypted data bags…
I do think it would be nice if Ansible Vault could integrate with HC's Vault in some way (especially for secret generation purposes, since that's not something ansible-vault does, really).
Re: Vault – A tool for managing secrets
#24Any reason why AWS dynamic credentials use IAM users instead of STS and role assumption? That seems to be a somewhat more widely accepted way to do dynamic credentials / role proxying.
that would definitely be more idiomatic in AWS
source: I am an Amazon employee
Re: Vault – A tool for managing secrets
#25How do I know I can trust this?
Read the source code: https://github.com/hashicorp/vault
Re: Vault – A tool for managing secrets
#26I know it is very new, but I would love to read a Vault vs Keywhiz [1] article.
Re: Vault – A tool for managing secrets
#27What are some of the existing tools/solutions which people use for managing secrets in a production environment?
slightly different scope, but solves a similar problem
https://github.com/cloudflare/redoctober
good writeup about it here
https://blog.cloudflare.com/red-october-cloudflares-open-sou...
Re: Vault – A tool for managing secrets
#28There are many solutions out there that attempt to solve the secrets distribution problem. Vault is the newest one. None of them solve the fundamental problem of the secret zero: provisioning the first secret on an untrusted system the automated way is hard, and without that secret zero, there is no way to authenticate the new system. With Vault, you still need to figure out how to push secret zero (here a client aut…
We worked with a handful of companies to help us design the "App ID" authentication backend that does exactly that: https://vaultproject.io/docs/auth/app-id.html It allows you to have a non-sensitive single factor within things like configuration management, and have the second factor come from a machine-local location (instance ID, MAC address, TSM module, etc.). The idea is that another team out of band sets the 2n…
That's definitely a trade-off compared to strong authentication, one that I wouldn't want to make in critical environments. But indeed a very nice feature for 99% of low/medium risk applications.
Re: Vault – A tool for managing secrets
#29> "Vault is the sixth such tool we've built. We've also built Vagrant, Packer, Serf, Consul, and Terraform. "
Sigh.
This is the first time that I actually feel overwhelmed. That nagging feeling that I'm doing something in some way solely because of habits. And that someone somewhere has created an awesome tool that would have allowed me to go home two hours earlier.
The amount of new tools cropping in the last couple of years alone is the 'culprit'.
These are awesome times, of course. Still, a part of my brain misses the time where you could ftp crap away to a server (even if automated by a Capistrano tool or similar) and spend the rest of the time arguing about the merits of puppet vs chef.
Re: Vault – A tool for managing secrets
#30> "Vault is the sixth such tool we've built. We've also built Vagrant, Packer, Serf, Consul, and Terraform. " Sigh. This is the first time that I actually feel overwhelmed. That nagging feeling that I'm doing something in some way solely because of habits. And that someone somewhere has created an awesome tool that would have allowed me to go home two hours earlier. The amount of new tools cropping in the last couple…
Use the tools that are useful to you. Plenty of people hack out great things on old toolsets. If you don't want to be overwhelmed, don't be.