Agreed. Vault is awesome, dynamically creating TLS certificates for VPN-usage, creating new MySQL usernames/passwords, with limited lifecycles, etc. Most of t

Agreed. Vault is awesome, dynamically creating TLS certificates for VPN-usage, creating new MySQL usernames/passwords, with limited lifecycles, etc. Most of the love I have for it is from things above and beyond mere static-secrets. It also has to be said that KMS will get expensive quickly too. Though it is probably fair to say that a three node vault installation with dynodb backend won't be so cheap it'll be rock-solid and I think it could be documented within an hour - for a develop to use it at least. Edit: I'd never heard of SOPS, apart from the many open issues and pull-requests making it look a little swamped, it seems like a nice tool. Especially given that it can work with GPG-keys.