Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp and Google: easing secret and infrastructure management

cloudplatform.googleblog.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: HashiCorp and Google: easing secret and infrastructure management

#71

Post by scrollaway »

ejcx wrote: post #16
scrollaway wrote: post #7

What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.

I almost never heard anything negative about vault until I did a presentation on all the troubles I had with it. Here are the slides about the issues I had: https://docs.google.com/presentation/d/1ipP2eB9pW5j3WDvzCGz9... At the end of the day, Vault gives you secret keys to manage which makes automating the unsealing process not fun if you want full automation. Talking with Armon from Hashicorp they planned to work o…

aws-vault and chamber both look fantastic. When was the talk given? Has the situation improved since? Would you still recommend both those tools over Hashicorp Vault?

Re: HashiCorp and Google: easing secret and infrastructure management

#72

Post by puzzle »

lmickh wrote: post #10
scrollaway wrote: post #7

What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.

Can't recommend Vault enough. By far the easiest and most capable solution to work with. The only downside I can point out is that the multi-cluster/region HA requires expensive enterprise licensing, but that is something most user cases don't require.

What's the Enterprise pricing?

Re: HashiCorp and Google: easing secret and infrastructure management

#73

Post by bogomipz »

lolbrish wrote: post #27
ejcx wrote: post #16

Earlier quoted context omitted.

I almost never heard anything negative about vault until I did a presentation on all the troubles I had with it. Here are the slides about the issues I had: https://docs.google.com/presentation/d/1ipP2eB9pW5j3WDvzCGz9... At the end of the day, Vault gives you secret keys to manage which makes automating the unsealing process not fun if you want full automation. Talking with Armon from Hashicorp they planned to work o…

I unseal using ansible (with the unseal keys in ansible-vault) and automate the configuration fully through ansible. For example you can use the ansible expect module: - name: unseal 1 expect: command: '/usr/bin/vault unseal' responses: 'Key \(will be hidden\): ': "{{vault_seal_key_1}}" echo: yes when: vault_sealed_result.rc == 2 and vault_seal_key_1 is defined tags: unseal

I'm interested in your solution, you are using ansible-vault to store the Hashicorp Vault unseal key(s)? Isn't this just pushing the problem out another level or am I missing something? Thanks.

Re: HashiCorp and Google: easing secret and infrastructure management

#74

Post by bogomipz »

ejcx wrote: post #16
scrollaway wrote: post #7

What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.

I almost never heard anything negative about vault until I did a presentation on all the troubles I had with it. Here are the slides about the issues I had: https://docs.google.com/presentation/d/1ipP2eB9pW5j3WDvzCGz9... At the end of the day, Vault gives you secret keys to manage which makes automating the unsealing process not fun if you want full automation. Talking with Armon from Hashicorp they planned to work o…

Thanks for sharing. Was your talk recorded by any chance? I would be interested in watching it.

Re: HashiCorp and Google: easing secret and infrastructure management

#75

Post by bogomipz »

toomuchtodo wrote: post #18
Johnny555 wrote: post #12

Earlier quoted context omitted.

Another option for Ansible is Ansible Vault (which is not related to Hashicorp Vault) -- you can use it to password protect secrets used for playbooks (you need to supply the password when you run the playbook). https://docs.ansible.com/ansible/latest/playbooks_vault.html

Ansible Vault is the bees knees compared to Hashicorp Vault (if you're already using Ansible). Very pleasant to use, A++ would use again.

Yes but Hashicporp Vault has a greater scope in that it addresses the secure introduction problem, provides single usage/read once tokens, tokens with TTLs and limited use, has audit capabilities etc. Although there is some overlap in general secret management between Ansible Vault and Hashicorp Vault, the latter is much broader than just a means of secure storage for config management.

Re: HashiCorp and Google: easing secret and infrastructure management

#76

Post by lmickh »

puzzle wrote: post #72
lmickh wrote: post #10

Earlier quoted context omitted.

Can't recommend Vault enough. By far the easiest and most capable solution to work with. The only downside I can point out is that the multi-cluster/region HA requires expensive enterprise licensing, but that is something most user cases don't require.

What's the Enterprise pricing?

IIRC, it was on the order of $100k+ per cluster for the Premium offering. Has been several months so I would suggest contacting them to see what it currently is.

For some projects I've been on, that wouldn't be a big deal. For smaller projects it can easily be several times your opex though.

You can run an open source cluster in HA without it though. The big draw for Enterprise is the multi-cluster and HSM support. Anything HSM is typically quite expensive so their pricing really isn't out of line.

Re: HashiCorp and Google: easing secret and infrastructure management

#77

Post by redwolfb14 »

ejcx wrote: post #16
scrollaway wrote: post #7

What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.

I almost never heard anything negative about vault until I did a presentation on all the troubles I had with it. Here are the slides about the issues I had: https://docs.google.com/presentation/d/1ipP2eB9pW5j3WDvzCGz9... At the end of the day, Vault gives you secret keys to manage which makes automating the unsealing process not fun if you want full automation. Talking with Armon from Hashicorp they planned to work o…

I read this presentation a little while ago and I felt it was slightly disingenuous. Many of the "problems" are process related and have nothing to do with vault itself. Then your approach is using ParameterStore which provides a UI and is built on the AWS ecosystem proper which I guess works if you are sticking to only AWS. I guess it comes down to how you view "secrets" but i'd rather that be spelled out than suggesting hard to automate and not easy to work with.

Re: HashiCorp and Google: easing secret and infrastructure management

#78

Post by toomuchtodo »

bogomipz wrote: post #75
toomuchtodo wrote: post #18

Earlier quoted context omitted.

Ansible Vault is the bees knees compared to Hashicorp Vault (if you're already using Ansible). Very pleasant to use, A++ would use again.

Yes but Hashicporp Vault has a greater scope in that it addresses the secure introduction problem, provides single usage/read once tokens, tokens with TTLs and limited use, has audit capabilities etc. Although there is some overlap in general secret management between Ansible Vault and Hashicorp Vault, the latter is much broader than just a means of secure storage for config management.

A lot of what Hashicorp Vault does is already provided for (in AWS at least) with KMS, Cloudtrail, Parameter Store, and IAM (which can be used in symphony with Ansible Vault).

I have very little experience with GCP and Azure, but it seems like Hashicorp is reinventing the wheel in AWS with Vault.

Post reply on HN