11–20 of 78 posts
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
https://docs.ansible.com/ansible/latest/playbooks_vault.html
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
What kind of secrets do others recommend relying on third parties like this to manage?
I worry a lot about how these megacorps will treat "collaborators" vs "non collaborators" in the coming years. Obviously you can't just outright buy everyone, but they seem to be increasingly abusive towards technologies and teams that aren't on board with their interests and ideology. Actually I'm more worried about how Facebook and Amazon treat non compliance, but Google sure seems to be getting shadier every day.…
This is a genuine collaboration effort by two of the players whose services many people are already using together, and they are making that experience better for their users.
The kind of dismissiveness and hyperbole in your comment is why we can't have nice things.
I worry a lot about how these megacorps will treat "collaborators" vs "non collaborators" in the coming years. Obviously you can't just outright buy everyone, but they seem to be increasingly abusive towards technologies and teams that aren't on board with their interests and ideology. Actually I'm more worried about how Facebook and Amazon treat non compliance, but Google sure seems to be getting shadier every day.…
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
https://docs.google.com/presentation/d/1ipP2eB9pW5j3WDvzCGz9...
At the end of the day, Vault gives you secret keys to manage which makes automating the unsealing process not fun if you want full automation.
Talking with Armon from Hashicorp they planned to work on some much improved docs around vault which should help with a lot of the issues of making vault usable, because quite frankly they are very challenging to understand right now.
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
I work at NuCypher (YC S16), and we're doing some pretty interesting stuff on the Ethereum block chain to build a decentralized KMS using proxy re-encryption.
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
Another option for Ansible is Ansible Vault (which is not related to Hashicorp Vault) -- you can use it to password protect secrets used for playbooks (you need to supply the password when you run the playbook). https://docs.ansible.com/ansible/latest/playbooks_vault.html
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
If you want something very simple, we've written our own wrapper around aws kms - for go and python. https://github.com/Zemanta/go-secretcrypt
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
Can't recommend Vault enough. By far the easiest and most capable solution to work with. The only downside I can point out is that the multi-cluster/region HA requires expensive enterprise licensing, but that is something most user cases don't require.
Secret management is as complex as the system which relies upon it. Vault is not as easy as many other tools designed for simple systems. GPG by itself is often enough to manage secrets.
There are probably 40 or more secret management solutions out there, many tailored for specific uses. Most CMS's have their own secret management baked in. Most orchestration and infrastructure tools do too. Four different solutions are called 'Vault'. There are at least 5 solutions just for Amazon. Depending on your platform, something other than HashiVault may be easier to adopt.
Here's some reviews of a dozen different solutions: https://gist.github.com/maxvt/bb49a6c7243163b8120625fc8ae3f3... https://medium.com/on-docker/secrets-and-lie-abilities-the-s... https://www.threatstack.com/blog/cloud-security-best-practic... https://www.youtube.com/watch?v=OUSvv2maMYI&feature=youtu.be