3 ms·

This looks great! But after looking through the docs and Github, I don't know what the architecture is beyond there is a CLI and a browser UI that interact with

This looks great! But after looking through the docs and Github, I don't know what the architecture is beyond there is a CLI and a browser UI that interact with some sort of central service. The main thing stopping me from using Vault is that it can become a central point of failure. If the cloud provider secret managers are down then its likely that something else in the cloud is having major issues as well so from an uptime perspective and easy of operations that has always seemed a safe approach, although the pricing is kind of outrageous. But just storing (e2e encrypted, etc) in cloud object storage is also an option. Berglass for example gives the option of storing in the secret manager or in cloud storage directly: https://github.com/GoogleCloudPlatform/berglas https://github.com/GoogleCloudPlatform/berglas

vmatsiiako 4y ago
Thank you! Besides the CLI and browser UI, we also support a range of integrations (we're still working on this but you can already see some of them in the Integrations section of our ReadMe: https://github.com/Infisical/infisical https://github.com/Infisical/infisical; or here in docs: https://infisical.com/docs/integrations/overview https://infisical.com/docs/integrations/overview). With that, you can auto-inject your secrets into those 3-rd party services. You can also inject your secrets into Kubernetes etc (https://infisical.com/docs/integrations/platforms/kubernetes https://infisical.com/docs/integrations/platforms/kubernetes). For larger teams, the web UI is also very useful since they can control which user is accessing what secrets, check the version history, and more! Vault's pricing is outrageous indeed! This is something that we tried to do differently with Infisical by providing a very generous free plan, so that community and small developer teams can use the service for free. The point about downtime is fair! Though, being open-source is also a big advantage here. You can self-host Infisical in the same place where you self-host your main app. This (slightly) minimises the risk of downtime with respect to your main project.
- gregwebs 4y ago
  I see. Some of the integrations, such as K8s would offload the downtime to k8s itself so then it wouldn't be much of a problem (other than alerting if the secret sync is broken). How do I stay up to date on developments for the AWS/GCP integration?
  - vmatsiiako 4y ago
    Indeed! Could you please join our community Slack (here is the link: https://join.slack.com/t/infisical-users/shared_invite/zt-1kdbk07ro-RtoyEt_9E~fyzGo_xQYP6g https://join.slack.com/t/infisical-users/shared_invite/zt-1k...)? We will be posting about all the major updates such as AWS/GCP integrations there

vmatsiiako 4y ago

Thank you! Besides the CLI and browser UI, we also support a range of integrations (we're still working on this but you can already see some of them in the Integrations section of our ReadMe: https://github.com/Infisical/infisical https://github.com/Infisical/infisical; or here in docs: https://infisical.com/docs/integrations/overview https://infisical.com/docs/integrations/overview). With that, you can auto-inject your secrets into those 3-rd party services. You can also inject your secrets into Kubernetes etc (https://infisical.com/docs/integrations/platforms/kubernetes https://infisical.com/docs/integrations/platforms/kubernetes). For larger teams, the web UI is also very useful since they can control which user is accessing what secrets, check the version history, and more! Vault's pricing is outrageous indeed! This is something that we tried to do differently with Infisical by providing a very generous free plan, so that community and small developer teams can use the service for free. The point about downtime is fair! Though, being open-source is also a big advantage here. You can self-host Infisical in the same place where you self-host your main app. This (slightly) minimises the risk of downtime with respect to your main project.

gregwebs 4y ago
I see. Some of the integrations, such as K8s would offload the downtime to k8s itself so then it wouldn't be much of a problem (other than alerting if the secret sync is broken). How do I stay up to date on developments for the AWS/GCP integration?
- vmatsiiako 4y ago
  Indeed! Could you please join our community Slack (here is the link: https://join.slack.com/t/infisical-users/shared_invite/zt-1kdbk07ro-RtoyEt_9E~fyzGo_xQYP6g https://join.slack.com/t/infisical-users/shared_invite/zt-1k...)? We will be posting about all the major updates such as AWS/GCP integrations there