3 ms·
I'm a little confused. Why does the problem with K8S secrets necessitate having multiple clusters? One could take advantage of a more secure secrets system inst
by otterley 5y ago
I'm a little confused. Why does the problem with K8S secrets necessitate having multiple clusters? One could take advantage of a more secure secrets system instead, such as Hashicorp Vault or AWS Secrets Manager.
- alexeldeib 5y agoThe point is that once you're talking about comparable setups, you need all of Vault/Nomad/Consul and the complexity of the setup is much more than just "one binary" as hashi likes to put it. > So now you have 3 separate Consul clusters, a Vault cluster, and a Nomad cluster. So what did you gain really? GP's point was already talking about running Vault clusters, not sure you realized we aren't only talking about nomad.
- otterley 5y agoThe only thing I was trying to say is that although K8S offers secrets "for free," it's not best practice to consider the control plane to be a secure secrets store.