3 ms·

Could this replace Vault?

• rileymichael 6y ago
  If your only use case for Vault is access to K/V secrets during a workflow (CD for example) -- then sure, it's a much simpler alternative. If you need access to secrets dynamically / at runtime (outside of the Actions container), or any of the other features Vault has, then no.
  • izolate 6y ago
    I’m not sure if you’re aware but the GitHub API provides dynamic access to the secrets so you can theoretically use it in your application/outside your workflow.
    • rileymichael 6y ago
      do you happen to have a link to the api docs for that? Everywhere I'm looking it doesn't return the value. https://developer.github.com/v3/actions/secrets/#get-a-repository-secret https://developer.github.com/v3/actions/secrets/#get-a-repos... and the blog states the same behavior I'm seeing in the docs: First, the API doesn’t return any values, only names. https://github.blog/2020-02-06-manage-secrets-and-more-with-the-github-actions-api/#managing-secrets https://github.blog/2020-02-06-manage-secrets-and-more-with-...
      • izolate 6y ago
        No, you're right, I was mistaken. Sorry about that.
• csomar 6y ago
  Not really. Vault offering is very extensive. Their product doesn't make much sense if all you were looking for was a simple deployment of your average amateur or small SaaS. Org and repositories secrets are simple security solutions for people who can't afford to use Vault.
• chucky_z 6y ago
  It makes using org-level AppRoles with Vault really easy, but I wouldn't replace Vault with this. I use org contexts with CircleCI today to do this with a very generic AppRole that has access too 'secrets that should be in Vault, but are generally safe.' e.g.: a consul credential that can read/write from the terraform state area.