8 ms·
Google Cloud’s Secrets Manager
- darkwater 7y agoThe title is missing the "Secret" word which makes a significant difference. "Cloud's Manager" vs "Cloud's Secret Manager". With the current title I was thinking about a generic cloud manager for GCloud
- sessy 7y agoComparable AWS Version: https://aws.amazon.com/secrets-manager/ https://aws.amazon.com/secrets-manager/ Pricing: AWS: $0.40 per secret per month. GCP: $0.06 per active secret version per regional replica per month. i don't understand the GCP pricing correctly. Can someone shine a light here ...
- vegardx 7y agoSeems more comparable to parameter store, which comes in both a paid and "free" version. Secrets Manager does have some of the same capabilities, but it also extends it to things like short lived credentials.
- deleted 7y ago[deleted]
- davedx 7y agoFor AWS, as with many cloud offerings, read the pricing small print: AWS Secret Manager also charges per API request [1]. It isn't expensive, but you should keep it in mind when you architect your infrastructure. (We actually switched from fetching secrets at runtime to injecting them into containers are deploy time, and this was one reason). https://aws.amazon.com/secrets-manager/pricing/ https://aws.amazon.com/secrets-manager/pricing/
- jaxr 7y agoThis bit us too. We use goodaddy's external secrets [1] to fetch secrets from AWS secrets manager and make them available to the cluster. It polls the secret every n seconds, but with many services consuming secrets, it can scale up pretty quickly and start to build up cost. [1] https://github.com/godaddy/kubernetes-external-secrets https://github.com/godaddy/kubernetes-external-secrets
- junar 7y agoYes, GCP also has a cost based on the number of API requests, according to this page: https://cloud.google.com/secret-manager/pricing https://cloud.google.com/secret-manager/pricing
- merb 7y agoyou can store gcp secrets, in multiple regions, so you pay for every region 0.06 cent, i.e. if you only want one region you only pay 0.06 cent
- sethvargo 7y agoSorry the pricing is unclear. In Secret Manager, secrets are versioned (a "secret" is a named collection of "secret versions"). We only charge for active secret versions (you can destroy secret versions, usually after a rotation operation). The secret version contains that actual secret data (i.e. "ABCD1234"), and you can choose the regions in which you want that secret data replicated. Each region you choose is $0.06. So if you had 1 secret with 12 versions stored in 2 regions, that would be 12 x 2 x $0.06/mo = $1.44. Hope that helps! EDIT: replaced "*" with "x" in math because it was getting parsed as italics
- Already__Taken 7y agoThis would be taking on Vaults top-tier enterprise package when looking at the feature list? https://www.hashicorp.com/products/vault/pricing/ https://www.hashicorp.com/products/vault/pricing/
- laumars 7y agoVault can do a lot more than AWS Secrets Manager -- possibly GCP too but I've not checked. So if you're paying for Vault (bare in mind Hashicorp also do a free version) then odds are you want enterprise features rather than an encrypted key/value store.
- tonyhb 7y agoVault does more than store secrets. For example, with Postgres it can store root creds and issue non-root, time-bound creds for each service. Vault's "backends" allow it to do _a lot_ of things that a secure static credentials manager can't. Not to say that this isn't good though – any proper secret management system is better than none :D
- rossmohax 7y agoVault is single system, accessible over the network with root access to all datastores in the company... How is it good for security? Kerberos solves very same problem of using only short lived tokens on the wire when accessing services, but it fall out of fashion .
- Jonnax 7y agoWhat are people's favoured ways of managing secrets these days? Does this look appealing?
- dijit 7y agoHashicorp vault is basically industry standard I believe. But there are various cloud APIs too, which have varying degrees of integration with kubernetes.
- Axsuul 7y agoUnfortunately Vault doesn't have a plugin yet for Docker Swarm still :(
- darkwater 7y agoBut is Swarm a valuable target? My feeling is that Swarm is going to be EOL'ed in not a so distant future.
- Jonnax 7y agoSwarm is on its way out. Mirantis bought that part of Docker and they said this: "The primary orchestrator going forward is Kubernetes. Mirantis is committed to providing an excellent experience to all Docker Enterprise platform customers and currently expects to support Swarm for at least two years, depending on customer input into the roadmap. Mirantis is also evaluating options for making the transition to Kubernetes easier for Swarm users." https://www.mirantis.com/blog/mirantis-acquires-docker-enterprise-platform-business/ https://www.mirantis.com/blog/mirantis-acquires-docker-enter...
- peterwwillis 7y agoThis is sad. Swarm is simple and effective, like Nomad but easier.
- fapjacks 7y ago
- dberg 7y agoHow does this differ from the KMS product ?
- acdha 7y agoKMS manages encryption keys. A secrets manager gives you an API for storing and referencing arbitrary named secret values with audit logs, etc. for them, which are encrypted using KMS. For example, this might be something like “store a secret ‘my app remote API key’ encrypted with a regularly rotated key and allow ‘my app container’ to retrieve the value”.
- antoncohen 7y agoThe short answer is KMS doesn't store secrets. You can use KMS as part of your own secret manager, but you would have to store the actual secrets somewhere else, like GCS or Datastore. KMS stores encryption keys, and has an API for encrypting/decrypting. For example to retrieve a secret using KMS you would get the encrypted data from where it is stored, like Datastore, and send it to KMS to have KMS decrypt the data. Secret Manager actually stores the secret, so a single API call can retrieve the decrypted value. Secret Manager also has versioning, which is important when rotating secrets. If you were building your own solution around KMS you would need to do versioning in your storage schema, wherever you end up storing the secrets.
- robohoe 7y agoYou can also use AWS Parameter Store with KMS (SecureString type) to store secrets in Parameter Store. Of course this doesn't offer rotation of the secrets although KMS will handle key rotation.
- patwolf 7y agoGlad to see this service exists. Until now I've been storing secrets in JSON files in Cloud Storage, and using KMS to encrypt the contents. This is hopefully simpler to use and easier to audit.
- sethvargo 7y agoEnable Cloud Audit Logging for Secret Manager and give us feedback. We know auditing is super important, so it's built in!
- ricktdotorg 7y agoso far, i've found the audit logging to be pretty great! i especially like exemptions; the ability to _not_ log for specific service accounts/identities is very handy.
- userbinator 7y agoI thought it would be a story about the elusive nature of the Google Cloud management people.
- degenerate 7y agoMe too. Everyone else calls key storage "Secrets Manager" (plural)
- csapdani 7y agoAs someone trying to move away from Google, no thanks.
- ackdesha 7y agoI'm hoping this eventually leads to AWS reducing their Secrets Manager pricing.
- nodesocket 7y agoHave you looked at just using AWS parameter store?
- cbushko 7y agoWe are eagerly awaiting GKE integration.
- sethvargo 7y agoWhile I cannot comment on specifics, we are going to provide deeper, first-class integrations with other GCP products.
- te_chris 7y agoYes, GKE would be great. If we could specify the source of an ENV in a Deployment as a Managed Secret that would be incredible and save us so much hassle.
- masonwr505 7y agowhile a bit of a toy still, might be of interest: https://github.com/masonwr/CloudSecret https://github.com/masonwr/CloudSecret. basic CRD that maps google "managed" secrets to Kubernetes secrets.
- gigatexal 7y agoMe too!
- sethvargo 7y agoHey everyone - sorry for the delayed reply, I've been on a plane. Seth from Google here, the same Seth in the byline of the blog post. We are very excited to bring Secret Manager to the market. Let us know if you have any questions!
- devy 7y agoHi Seth! I wonder how is GCP Secrets Manager comparing to Hashicorp Vault? Is GCP SM implemented in Hashicorp Vault (or Berglas) behind the scene? If not, what are the differences in terms of feature set?
- dannyrosen 7y agoHey Seth, I know there's been _quite_ the effort under the hood to make this product a reality and am curious if you would be open to writing a bit about lessons learned to help others learn about the research & development process.
- sethvargo 7y agoSure - in short, we partnered with multiple customers in designing and building this service. Let me check with my team and see what we _can_ talk about :)
- deleted 7y ago
- rags1811 7y agoHow do permissions work? Can I only give access to a specific secret to a specific person/group of people? Playing with Secrets Manager it looks like anyone with access to the project can access all secrets.
- ricktdotorg 7y ago> Can I only give access to a specific secret to a specific person/group of people? yes. > Playing with Secrets Manager it looks like anyone with access to the project can access all secrets. just FYI, this is not the case. the "Secret Manager Secret Accessor" role must be applied per-secret for any identity to read the content of that secret.