3 ms·
We use terraform to describe cloud infrastructure, check all k8s configmaps and secrets into source control (using sops to securely store secrets in git).
by SirensOfTitan 7y ago
We use terraform to describe cloud infrastructure, check all k8s configmaps and secrets into source control (using sops to securely store secrets in git).
- xref 7y agoCurious about why you're using SOPS [1] instead of say, hashicorp vault or AWS/GCP's integrated keystores or git-crypt, etc? [1] https://github.com/mozilla/sops https://github.com/mozilla/sops
- SirensOfTitan 7y agoI found vault a pain to setup and maintain. I think security solutions should be as simple as possible so people use them and understand them. What I like about SOPs is that we still leverage AWS keystore to store our master key, but we store encrypted secrets in git. This is helpful as we have a history of rotations (great for rollbacks, audits, etc). Additionally, SOPs doesn’t encrypt yaml keys, so one can tell what a secret is but not its values.