3 ms·
The problem with Hashicorp Vault (and their peers): Your application still need a secret to access values made available to your application's role. The values
by falcolas 6y ago
The problem with Hashicorp Vault (and their peers): Your application still need a secret to access values made available to your application's role.
The values might not be in the immediate container space (well, aside from being in program memory), but they're only one (likely well documented internally to the container) hop away.
- laumars 6y ago> The problem with Hashicorp Vault (and their peers): Your application still need a secret to access values made available to your application's role. True but those credentials can be decoupled from the application (like env vars are) so you satisfy the developer problem I was addressing.
- andrewnicolalde 6y agoI've constantly tried to figure out the answer to this. Is there literally any solution to this that doesn't involve the access key for the secrets vault being supplied by human input / secure hardware? But even in the case of secure hardware, if the hardware trusts the requesting application and that application becomes compromised, doesn't that defeat the purpose? Where is trust anchored?