3 ms·
Here's to hoping there's finally a Hashicorp Vault competitor. It's shocking that the only mature option for runtime secret delivery is Vault after all these ye
by bsamuels 5y ago
Here's to hoping there's finally a Hashicorp Vault competitor. It's shocking that the only mature option for runtime secret delivery is Vault after all these years.
Some companies have created 'competitors', but they aren't even remotely mature (google secrets manager, aws secret manager, etc)
- w0m 5y agoI've had good luck with Azure KeyVault.
- brianhorakh 5y agoDitto. The managed service provider VS user assigned rbac was confusing at first, but now I am happy that I took the time to understand it. Also the azure clouds handling of vaulted passwords in log files from services like Logic apps) is absolutely bad ass.
- haswell 5y ago> Also the azure clouds handling of vaulted passwords in log files from services like Logic apps) is absolutely bad ass. This is particularly interesting to me. Is there a good doc page or blog post that you're aware of that covers these capabilities? I'm curious and would love to learn more.
- trevorishere 5y agoKeyVault is ideal when combined with Managed Identities. I would not leverage any service that required a connection string to access a secret.
- DangitBobby 5y agoWhat are your criticisms of Google secrets manager? It works well for me, but it's the only one I've used so I don't know much about the competition.
- bsamuels 5y agoBy far the biggest missing control is you can't restrict access to google secrets manager by source CIDR. There were a bunch of other smaller nitpicks, but that was the overwhelming reason last time I looked at it.
- tedk-42 5y agoIAM policies are designed for this reason, not IP based access controls. E.g. in AWS you can specify the source CIDR range in an IAM policy.
- bombcar 5y agoThe two you mentioned have ingrained business reasons to only work with "their" ecosystem. You need someone from outside to have an incentive to work with all.
- frenchman99 5y agoVault is open source, it looks like 1Password Secrets is closed source. Not really comparable. Probably not aimed at the same people.
- drcongo 5y agoWe use EnvKey [0], it's far friendlier to use than Vault and very mature. My only dislike is the Electron based app, but I so rarely have to open it that I can live with it. https://www.envkey.com https://www.envkey.com
- whycombagator 5y agoStill no option to self host. The founder of Envkey claimed they were working hard on V2 and self hosting 1.5 years ago[0] so it’s anyone’s guess as to why that’s been delayed/isn’t happening. [0] https://news.ycombinator.com/item?id=21226715 https://news.ycombinator.com/item?id=21226715
- danenania 5y agoHi, I can assure you that it’s very much still in the works! It’s taken much longer than we wanted or anticipated, as we’re addressing a lot more than just self-hosting (though that’s an important piece). But we’re on the home stretch. Stay tuned.
- Ozzie_osman 5y agoAlso a big fan of EnvKey here. We used them for over a year but ended up moving to AWS parameter store as part of a wider migration. Ability to self-host could have helped us stay on there longer, we just didn't want external dependencies in such a critical path. But otherwise, it served us well with zero hiccups.
- bastijn 5y agoYou also have options like https://www.doppler.com/ https://www.doppler.com/.
- stimur 5y ago[I work for 1Password] 1Password is not competing with Vault. In fact we have very good relationships and mutual respect with HashiCorp on many levels. Also Secret automation integrates (acts as a provider) with HC Vault[0] 0: https://github.com/1Password/vault-plugin-secrets-onepassword https://github.com/1Password/vault-plugin-secrets-onepasswor...