5 ms·

For those that moved to or from Vault, care to share your experiences? I'm using a fairly niche/small product to manage secrets at the moment but we're hitting

For those that moved to or from Vault, care to share your experiences? I'm using a fairly niche/small product to manage secrets at the moment but we're hitting scaling and response time problems for a globally distributed team. We're already using AWS so we're tossing up using Secrets Manager instead and changing our tooling accordingly, but after starting down the path of using some of HashiCorps other products I'm wondering how Vault will go too.

mitchellh 7y ago
I'll give my biased response, but I hope you can see I'm trying to be fair and honest too. Note I'm one of the founders of HashiCorp and original creators of Vault. If your challenge is just storing static secrets (think key/value), Vault is probably overkill for you today. Secrets Manager will work fine, or even a smaller KMS-based solution or something. We're working on making Vault a LOT easier to get started with so this probably won't be true for long, but its probably true today. But it is important to understand the tradeoffs of making these decisions. The value of Vault is in the fact that it does so much more: dynamic secrets, automatic rotation, certificate management, encryption-as-a-service, etc. And that it integrates with so many systems: log in with AWS IAM, or K8S service principles, or OIDC (Google, GitHub, etc.). And it has a single policy and auditing system to back all this. Usually Vault becomes VERY beneficial when you're juggling multiple "secret-like" solutions: diff password solution from key management from PKI etc etc OR you want to adopt more modern practices like dynamic credentials OR you want a way to centrally govern secret-like things. Vault literally scales from solving the needs of a small team (static KV) to being used by some of the Fortune 10 to back their entire corporate secret, PKI, encryption, signing requirements in a centralized way. I think that's kind of neat.
- weitzj 7y ago
  Vault is phenomenal. Do you know by chance whether Vault has a pkcs11 Plug-in? So one can offload certain crypto operations into an HSM? (apart from the masterkey) i.e. I would like to use the PKI from vault but the key of the CA has to live in an HSM.
  - Operyl 7y ago
    Would a trade off be having an intermediary for your CA that vault controls the key for? That seems to be the common configuration I’ve seen at least.
    - weitzj 7y ago
      This is the configuration I would prefer as well. But for my question I already had an intermediate CA in mind and where to store its key. The rootca is offline
  - Daegalus 7y ago
    We use Vault Enterprise at my company, and I do a lot of the deployment/adminsitration of vault. The enterprise version supports PKCS11 and external HSM: https://www.vaultproject.io/docs/configuration/seal/pkcs11.html https://www.vaultproject.io/docs/configuration/seal/pkcs11.h... and https://www.vaultproject.io/docs/configuration/entropy-augmentation/index.html https://www.vaultproject.io/docs/configuration/entropy-augme... for reference. https://learn.hashicorp.com/vault/operations/ops-seal-wrap https://learn.hashicorp.com/vault/operations/ops-seal-wrap is a guide linked at the bottom
    - weitzj 7y ago
      Thanks. So to fully understand this - if I use seal wrapping with an HSM all secrets in Vault will be wrapped by the HSM and not only the masterkey/autounseal? And even though the rest is then in software (Vault) I still have the same FIPS level as the HSM?
  - viralpoetry 7y ago
    there is an issue to track this one already https://github.com/hashicorp/vault/issues/6991 https://github.com/hashicorp/vault/issues/6991
- silviogutierrez 7y ago
  Great description, thank you. My main question is: I use https://github.com/shyiko/kubesec https://github.com/shyiko/kubesec (a fancy sops) for k8s and store my database password, stripe credentials, etc in there. Other than that, I have my GCP account credentials (in 1Password) and my terraform state in... terraform. Is this a use case for Vault to consolidate? I guess I can't see how I would "outgrow" the above setup. Thanks for all the great Hashicorp products! Terraform is incredible.
  - weitzj 7y ago
    This may be interesting for you - a vault terraform provider using envelope encryption To get secrets from terraform into vault https://medium.com/faun/provisioning-vault-encrypted-secrets-using-terraform-using-sumup-oss-vaulted-and-4aa9721d082c https://medium.com/faun/provisioning-vault-encrypted-secrets...
akdor1154 7y ago
Secrets manager is fine if you just have plain text secrets that you are happy to rotate yourself. Vault shines when you want more dynamic secrets - issuing IAM creds from other forms of auth, issuing dynamic SQL db users, even issuing tls certificates. Edit: damn, ninja'd
ccakes 7y ago
If you’re using Nomad then the integration towards Vault is quite good. Even if you don’t require any of the more complex features (auto-rotation, transit encryption/signing etc) it gives you the option to build a roadmap towards getting there.
packetized 7y ago
Vault is a phenomenal tool, full stop.
esseti 7y ago
I'm starting using it as an encryption-as-a-service. Nice and good to add layers of complexity and have to avoid stuff that generally people ignore (algorithms, rotation, master keys etc), documentation is scattered around and not always to the point, but with a bit of time you get what is needed. Still fighting with setting up with wrap/unwrapping roles and tokens. In the end it's a tool and you have to build stuff around it. Anyway, so far so good. If you have to encrypt/decrypt things I would suggest you to give it a try.
viralpoetry 7y ago
I am managing Vault cluster on a quite unstable infrastructure (private openstack, occasional outages of some VMs). We are running 3 vault nodes and 5 consul servers (all open source version) as a storage backend and it is really resilient and easy to upgrade by rolling upgrades. From the usability perspective, you have to coach people and make documentation on usage, but once you onboard services/pipelines and leverage identity backend with some 3rd party authentication it's good. the only problem with OSS version is georedundancy.

mitchellh 7y ago

I'll give my biased response, but I hope you can see I'm trying to be fair and honest too. Note I'm one of the founders of HashiCorp and original creators of Vault. If your challenge is just storing static secrets (think key/value), Vault is probably overkill for you today. Secrets Manager will work fine, or even a smaller KMS-based solution or something. We're working on making Vault a LOT easier to get started with so this probably won't be true for long, but its probably true today. But it is important to understand the tradeoffs of making these decisions. The value of Vault is in the fact that it does so much more: dynamic secrets, automatic rotation, certificate management, encryption-as-a-service, etc. And that it integrates with so many systems: log in with AWS IAM, or K8S service principles, or OIDC (Google, GitHub, etc.). And it has a single policy and auditing system to back all this. Usually Vault becomes VERY beneficial when you're juggling multiple "secret-like" solutions: diff password solution from key management from PKI etc etc OR you want to adopt more modern practices like dynamic credentials OR you want a way to centrally govern secret-like things. Vault literally scales from solving the needs of a small team (static KV) to being used by some of the Fortune 10 to back their entire corporate secret, PKI, encryption, signing requirements in a centralized way. I think that's kind of neat.

weitzj 7y ago
Vault is phenomenal. Do you know by chance whether Vault has a pkcs11 Plug-in? So one can offload certain crypto operations into an HSM? (apart from the masterkey) i.e. I would like to use the PKI from vault but the key of the CA has to live in an HSM.
- Operyl 7y ago
  Would a trade off be having an intermediary for your CA that vault controls the key for? That seems to be the common configuration I’ve seen at least.
  - weitzj 7y ago
    This is the configuration I would prefer as well. But for my question I already had an intermediate CA in mind and where to store its key. The rootca is offline
- Daegalus 7y ago
  We use Vault Enterprise at my company, and I do a lot of the deployment/adminsitration of vault. The enterprise version supports PKCS11 and external HSM: https://www.vaultproject.io/docs/configuration/seal/pkcs11.html https://www.vaultproject.io/docs/configuration/seal/pkcs11.h... and https://www.vaultproject.io/docs/configuration/entropy-augmentation/index.html https://www.vaultproject.io/docs/configuration/entropy-augme... for reference. https://learn.hashicorp.com/vault/operations/ops-seal-wrap https://learn.hashicorp.com/vault/operations/ops-seal-wrap is a guide linked at the bottom
  - weitzj 7y ago
    Thanks. So to fully understand this - if I use seal wrapping with an HSM all secrets in Vault will be wrapped by the HSM and not only the masterkey/autounseal? And even though the rest is then in software (Vault) I still have the same FIPS level as the HSM?
- viralpoetry 7y ago
  there is an issue to track this one already https://github.com/hashicorp/vault/issues/6991 https://github.com/hashicorp/vault/issues/6991
silviogutierrez 7y ago
Great description, thank you. My main question is: I use https://github.com/shyiko/kubesec https://github.com/shyiko/kubesec (a fancy sops) for k8s and store my database password, stripe credentials, etc in there. Other than that, I have my GCP account credentials (in 1Password) and my terraform state in... terraform. Is this a use case for Vault to consolidate? I guess I can't see how I would "outgrow" the above setup. Thanks for all the great Hashicorp products! Terraform is incredible.
- weitzj 7y ago
  This may be interesting for you - a vault terraform provider using envelope encryption To get secrets from terraform into vault https://medium.com/faun/provisioning-vault-encrypted-secrets-using-terraform-using-sumup-oss-vaulted-and-4aa9721d082c https://medium.com/faun/provisioning-vault-encrypted-secrets...

akdor1154 7y ago

Secrets manager is fine if you just have plain text secrets that you are happy to rotate yourself. Vault shines when you want more dynamic secrets - issuing IAM creds from other forms of auth, issuing dynamic SQL db users, even issuing tls certificates. Edit: damn, ninja'd

ccakes 7y ago

If you’re using Nomad then the integration towards Vault is quite good. Even if you don’t require any of the more complex features (auto-rotation, transit encryption/signing etc) it gives you the option to build a roadmap towards getting there.

packetized 7y ago

Vault is a phenomenal tool, full stop.

esseti 7y ago

I'm starting using it as an encryption-as-a-service. Nice and good to add layers of complexity and have to avoid stuff that generally people ignore (algorithms, rotation, master keys etc), documentation is scattered around and not always to the point, but with a bit of time you get what is needed. Still fighting with setting up with wrap/unwrapping roles and tokens. In the end it's a tool and you have to build stuff around it. Anyway, so far so good. If you have to encrypt/decrypt things I would suggest you to give it a try.

viralpoetry 7y ago

I am managing Vault cluster on a quite unstable infrastructure (private openstack, occasional outages of some VMs). We are running 3 vault nodes and 5 consul servers (all open source version) as a storage backend and it is really resilient and easy to upgrade by rolling upgrades. From the usability perspective, you have to coach people and make documentation on usage, but once you onboard services/pipelines and leverage identity backend with some 3rd party authentication it's good. the only problem with OSS version is georedundancy.