3 ms·

I like Ansible's approach to this better. We keep all our secrets in ansible-vault and have a password to unlock it for those "who need to know". Sure, this me

I like Ansible's approach to this better. We keep all our secrets in ansible-vault and have a password to unlock it for those "who need to know". Sure, this means provisioning VM's requires human interaction to unlock the vault (once) during a kickstart. So what. I'd rather do that than have plaintext or even pre-hashed passwords lying around in source control. As others have pointed out, Hashicorp Vault seems like a good solution to the problems of another Hashicorp product ... Terraform, which used to keep passwords in its state files (not sure if it still does).

athenot 8y ago
You can also configure Ansible to lookup to Hashicorp Vault on the fly. https://docs.ansible.com/ansible/2.5/plugins/lookup/hashi_vault.html https://docs.ansible.com/ansible/2.5/plugins/lookup/hashi_va...
- nineteen999 8y ago
  Unfortunately it wouldn't work for our network even if I wanted to use it, since our systems aren't allowed to connect outbound to the Internet (for good reason). I suppose I could set up a Vault server locally (?), but it's complete overkill for a problem we already solved in a simpler way. Ansible is gradually adding modules for about everything. It's come along way since I started using it back in the 1.8 or 1.9 days.
  - jyounker 8y ago
    Vault is usually hosted in-house. Vault offers features such as short-term secrets which are unique to each client. Vault itself manages creation and destruction of the credentials on the server, allowing it to enforce credential lifetimes
    - nineteen999 8y ago
      Those are neat features, but our systems do not require them, and for our small team it would be unnecessary overhead. And by in house, I presume you would mean within a cloud hosted environment, eg. AWS VDC, Google Cloud etc. in the most common case.
nimrody 8y ago
How do you handle autoscaling? Server restart? Autoscaling requires credentials as part of the VM image. For server restart the credentials must be stored on the machine.
- nineteen999 8y ago
  Not everybody uses or needs autoscaling. In fact I would venture that the vast majority of companies doing business on the internet, even those that have sunk their money into the cloud computing gold rush, do not need autoscaling.
  - forty 8y ago
    I would argue that everyone needs auto scaling, even if it's only to use it to scale manually, or change/upgrade instances easily. Being able to just tell your auto scaling group to do +3 then -3 to replace your 3 instances without downtime is quite nice.
    - nineteen999 8y ago
      We host internally on our own hardware and have other much simpler ways of achieving the same thing, should we need to.

athenot 8y ago

You can also configure Ansible to lookup to Hashicorp Vault on the fly. https://docs.ansible.com/ansible/2.5/plugins/lookup/hashi_vault.html https://docs.ansible.com/ansible/2.5/plugins/lookup/hashi_va...

nineteen999 8y ago
Unfortunately it wouldn't work for our network even if I wanted to use it, since our systems aren't allowed to connect outbound to the Internet (for good reason). I suppose I could set up a Vault server locally (?), but it's complete overkill for a problem we already solved in a simpler way. Ansible is gradually adding modules for about everything. It's come along way since I started using it back in the 1.8 or 1.9 days.
- jyounker 8y ago
  Vault is usually hosted in-house. Vault offers features such as short-term secrets which are unique to each client. Vault itself manages creation and destruction of the credentials on the server, allowing it to enforce credential lifetimes
  - nineteen999 8y ago
    Those are neat features, but our systems do not require them, and for our small team it would be unnecessary overhead. And by in house, I presume you would mean within a cloud hosted environment, eg. AWS VDC, Google Cloud etc. in the most common case.

nimrody 8y ago

How do you handle autoscaling? Server restart? Autoscaling requires credentials as part of the VM image. For server restart the credentials must be stored on the machine.

nineteen999 8y ago
Not everybody uses or needs autoscaling. In fact I would venture that the vast majority of companies doing business on the internet, even those that have sunk their money into the cloud computing gold rush, do not need autoscaling.
- forty 8y ago
  I would argue that everyone needs auto scaling, even if it's only to use it to scale manually, or change/upgrade instances easily. Being able to just tell your auto scaling group to do +3 then -3 to replace your 3 instances without downtime is quite nice.
  - nineteen999 8y ago
    We host internally on our own hardware and have other much simpler ways of achieving the same thing, should we need to.