Vault 0.4 released – a tool for managing secrets
hashicorp.com
Vault 0.4 released – a tool for managing secrets
1–10 of 23 posts
Re: Vault 0.4 released – a tool for managing secrets
#2There sure are a lot of these systems these days. While I'm always happy to see innovation in this area, I'm personally beginning to get confused as to why I might prefer to use (and probably then contribute to) one of these projects over another. After all, there's this, and Lyft's Confidant [1], and Square's Keywhiz [2], and plenty more that don't come to mind right now. They all have nice documentation about what they do, but none of them sufficiently explain to me what architectural differences they have, their pros and cons. I think it would be great to see that added to these products' pages at best, or at least some guy write a blog post about it.
[1] https://lyft.github.io/confidant/ [2] https://square.github.io/keywhiz/
Re: Vault 0.4 released – a tool for managing secrets
#3There sure are a lot of these systems these days. While I'm always happy to see innovation in this area, I'm personally beginning to get confused as to why I might prefer to use (and probably then contribute to) one of these projects over another. After all, there's this, and Lyft's Confidant [1], and Square's Keywhiz [2], and plenty more that don't come to mind right now. They all have nice documentation about what…
> none of them sufficiently explain to me what architectural differences they have, their pros and cons.
Have you looked at https://vaultproject.io/intro/vs/index.html ?
Re: Vault 0.4 released – a tool for managing secrets
#4There sure are a lot of these systems these days. While I'm always happy to see innovation in this area, I'm personally beginning to get confused as to why I might prefer to use (and probably then contribute to) one of these projects over another. After all, there's this, and Lyft's Confidant [1], and Square's Keywhiz [2], and plenty more that don't come to mind right now. They all have nice documentation about what…
There's probably some strategy tax at work here since Hashicorp is trying to build a self-contained ecosystem of devops/microservices tools.
Re: Vault 0.4 released – a tool for managing secrets
#5Someone correct me if I'm wrong but Vault on its own (without an agent) would be quite difficult to use in a simple web application setup, no?
For example let's say I store an API token in Vault and want to use that in my Node.js application.
That means I can't do "var api_token = MY_API_TOKEN;" because the secret needs to come from vault and get refreshed, etc...
I'd imagine you will need some agent to manage the secret lease/expiry and for that to reload your entire application to ensure you don't end up with old secrets hanging around in the memory.
This topic is not addressed anywhere in the Vault documentation, I looked everywhere I could.
Re: Vault 0.4 released – a tool for managing secrets
#6There sure are a lot of these systems these days. While I'm always happy to see innovation in this area, I'm personally beginning to get confused as to why I might prefer to use (and probably then contribute to) one of these projects over another. After all, there's this, and Lyft's Confidant [1], and Square's Keywhiz [2], and plenty more that don't come to mind right now. They all have nice documentation about what…
> none of them sufficiently explain to me what architectural differences they have, their pros and cons. Have you looked at https://vaultproject.io/intro/vs/index.html ?
This page does not adequately address many of the practical questions that orgs with secrets should be asking.
Examples:
* Does it integrate with my existing infrastructure security policies? * Does it introduce a new set of principals for me to track and manage? * Are the configurations stored in a cleartext manner suitable for storing in version control? * Will the audit logs integrate with my existing audit log tooling? * Does it help or hinder continuous deployment? In other words, will my code be littered by conditionals to support non-prod jobs? * Can my devops team run this or does it require additional staffing? * How many layers is this adding between me and the security primitives offered by my platform (Windows AD, AWS IAM, etc) * Is it serverless, or does it require me to run additional servers? * How do I ensure continuity if the software is no longer actively developed? * Can it deploy secrets to dev and test environments in the same way? * What's the revocation story?
The answers to most of these questions for most of the tools that have made it to HN recently are not promising. For AWS the best choice seems to be using KMS directly and integrating your app with the declarative configuration tools AWS offers (IAM, CF, MFA).
Outside of AWS, Vault is the only one that I've seen which handles real-world end-to-end in a responsible way. For example, Vault is the only one that doesn't focus strictly on storing static values: Vault can integrate with services such as Postgres and SSH to dynamically provision time-limited credentials (https://vaultproject.io/docs/secrets/postgresql/index.html).
Re: Vault 0.4 released – a tool for managing secrets
#7Someone correct me if I'm wrong but Vault on its own (without an agent) would be quite difficult to use in a simple web application setup, no? For example let's say I store an API token in Vault and want to use that in my Node.js application. That means I can't do "var api_token = MY_API_TOKEN;" because the secret needs to come from vault and get refreshed, etc... I'd imagine you will need some agent to manage the se…
In the past I've thought about using the an ec2-meta-data style endpoint for secrets that would accessible by an agent with some sort of key. that way the application always dynamically requests the secret as oppose to setting it statically at launch.
Re: Vault 0.4 released – a tool for managing secrets
#8There sure are a lot of these systems these days. While I'm always happy to see innovation in this area, I'm personally beginning to get confused as to why I might prefer to use (and probably then contribute to) one of these projects over another. After all, there's this, and Lyft's Confidant [1], and Square's Keywhiz [2], and plenty more that don't come to mind right now. They all have nice documentation about what…
> none of them sufficiently explain to me what architectural differences they have, their pros and cons. Have you looked at https://vaultproject.io/intro/vs/index.html ?
+1 to what whisk3rs said, as that's how I feel, as well.
For example using Vault v. Keywhiz [1] since I made that comparison earlier, this page feels like it's written to say "Vault does X. Keywhiz does too." That's not really what I'm looking for; I can diff the two projects' features in that way as well, but I want to know why it is that Vault is better, i.e., why is it that it exists, what sets it apart from other solutions I can use? Why should I invest my time and port my infrastructure into this project? Should I expect it to be around or abandoned in a year if there is no adoption?
I probably should have clarified this in my original post; sorry for the confusion.
Re: Vault 0.4 released – a tool for managing secrets
#9Earlier quoted context omitted.
> none of them sufficiently explain to me what architectural differences they have, their pros and cons. Have you looked at https://vaultproject.io/intro/vs/index.html ?
+1 to what whisk3rs said, as that's how I feel, as well. For example using Vault v. Keywhiz [1] since I made that comparison earlier, this page feels like it's written to say "Vault does X. Keywhiz does too." That's not really what I'm looking for; I can diff the two projects' features in that way as well, but I want to know why it is that Vault is better , i.e., why is it that it exists, what sets it apart from othe…
I'm one of the Keywhiz developers, and we've been considering writing such a page, though I've been hesitant to do so because I'm not totally familiar with the alternatives: I have no operational experience with Vault or alternatives, and haven't put a ton of thought into this comparison.
From my limited perspective: Keywhiz is a system to take secrets, stored in a database, decrypt them with an HSM backed key, and expose them as files on a server. Because the secrets are exposed as a fuse filesystem, they require zero special code in your applications. Most other secrets stores just provide you with an API that requires custom integration work. You could probably even modify keywhiz-fs to talk to a Vault server.
On the other hand, Keywhiz doesn't know anything about the secrets inside it, so there's not much out of the box for secrets revocation, and other operations like that. There's also minimal secrets generation: We just provide an API to handle that. The biggest sources of secrets for us are service-to-service TLS certs, generated from our deploy system, which just calls the automation API to put the certs it gets from our internal CA. Keywhiz has a plugin system for generating secrets, but it's quite simple compared to what Vault has.
Vault also has some operational decisions that seem scary to me. They have a scheme for "unsealing" a vault with a set of secrets an operator has to input. This seems quite likely to cause an outage, while defending against an attacker you've noticed but who hasn't managed to steal the secrets out of your unsealed vault. While operating, your vault is unsealed, so an attacker who gets root has your secrets in both Keywhiz and Vault, but a service restart causes an outage. If you could somehow (via physical access, perhaps) boot a malicious OS onto a Keywhiz server, and your HSM doesn't defend against that, you could read secrets. For Vault, you also need to steal the keys to unseal. But those are accessible to humans, so that's probably easy.
As for lifetime, we don't expect Keywhiz to go anywhere. It's a crucial part of running Square. We've been using it for years now (though only open-sourced it earlier this year), and will probably continue to exist as long as the company does.
I'm happy to answer any other questions, too.
Re: Vault 0.4 released – a tool for managing secrets
#10Can somebody tell me how Hashicorp makes money? They seem to employ people, and they have a page that sends traffic off to technology and solutions partners, but where do they make their own money?
We use Vagrant at work and I'm considering whether and how we could use more of their tooling. But I always want to know about the business model behind the tools I recommend before I recommend them.
Anyone?