3 ms·
I am very happy I learned how to use vault from hashicorp. It's great for having a rest-enabled CA and can do a lot of other stuff too. And if you're into kube
by znpy 6y ago
I am very happy I learned how to use vault from hashicorp. It's great for having a rest-enabled CA and can do a lot of other stuff too.
And if you're into kubernetes and/or run your own little kubernetes cluster at home, cert-manager can issue certificates off vault too.
- danmur 6y agoVault is ridiculously easy to use for this.
- visualphoenix 6y agoVault as a CA is also ridiculously painful. This comes from the battlefield.
- danmur 6y agoI haven't used it seriously for that purpose so I can't comment :). Just my home setup. Their other products have their rough edges though so I can understand.
- znpy 6y agoWe use it in prod for secret storage and management (and maybe someday for CA) and I use at home for my own ca and btw it's surprisingly simple and effective.
- jrockway 6y agoI use cert-manager for internal mTLS and am satisfied with it. I found it surprisingly easy to use compared to things that try to be automatic, like linkerd and istio. (Plus, I can verify the authenticity of the connection at the application layer, and make appropriate decisions rather than having to trust "oh yeah, the sidecar has it under control, nothing to see here".) It's a downgrade in security compared to pressing a physical button a YubiKey every so often... but I am OK with things being automatically renewed. (It basically means, if you own the apiserver, you own the network, which is a tradeoff I can live with. Compare this to "if you can intercept any packet, you own the network", which is what non-mTLS is.)