4 ms·

Secrets or credential management is hard, but the first step is to centralise. Ah yes, the "all eggs, one basket" approach to secret management. This is the c

Secrets or credential management is hard, but the first step is to centralise. Ah yes, the "all eggs, one basket" approach to secret management. This is the correct approach, if you are trying to sell a platform -- gets you lock-in, and if you fail to keep secrets secure, you were going to blow up anyways, so the business risk management dictates that you should shoot for the moon and risk your client's data in the hopes of getting traction.

jacques_chester 9y ago
That's definitely one way of looking at it. Another view is that: 1. You can't invest in heavily defending scattered resources. 2. Individual teams are not all experts in secret management. Pivotal started CredHub (it's now in the Cloud Foundry Incubation process) partly because of client requests and partly because of the problems we and our fellow Cloud Foundry Foundation members have encountered. There are literally thousands of secrets and credentials scattered across dozens of teams, including hundreds of high-risk operational secrets. We have had multiple unintentional leakages, usually git. It's so easy that we now have tools to watch commits and checkouts for secret-like patterns. The same tools constantly comb our repositories for possible secrets as well. Development teams should not need to care. Operators should not need to have to hand-manage thousands of secrets. There should be a safe, sane, central, highly assured place or places to keep your secrets.