4 ms·

A major use-case for Vault is dynamic generation of secrets, like rotating roles in a Postgres DB or acting as CA (issuing/revoking certs) in a PKI infra. Some,

by 3np 3y ago

A major use-case for Vault is dynamic generation of secrets, like rotating roles in a Postgres DB or acting as CA (issuing/revoking certs) in a PKI infra. Some, like the former, needs to hold secrets for and communicate with external services. How easy is this to achieve using EnvKey? Only allusion I see on the comparison page is "Easy Integration: Vault=Poor, EnvKey=Strong" but I have a feeling something else was in mind there.

danenania 3y ago
Yeah, "easy integration" is more speaking to how you get secrets from Vault/EnvKey through to an app. Dynamic secrets generation isn't built in to EnvKey, but we do offer a CLI that makes it straightforward to generate or rotate credentials/roles as part of your deployment. Rather than baking in this kind of thing, we are more taking a 'give you simple building blocks so you can do anything' approach to automations. For your postgres example, it would look something like this: # Set variables for an EnvKey environment that includes postgres admin creds in shell eval $(envkey-source) # Use the admin credentials from EnvKey to rotate credentials for app role in Postgres. # You could also create new roles, grant privileges, etc., as needed. NEW_PASSWORD=$(openssl rand -base64 32) psql -h $DB_HOST -U $DB_ADMIN_USER -d $DATABASE_NAME -c "ALTER ROLE $ROLE_NAME WITH PASSWORD '$NEW_PASSWORD';" # Update the credentials in EnvKey for your app. envkey set app-name production DB_PASSWORD=$NEW_PASSWORD --commit --json Meanwhile, if you prefix your app start command like this: envkey-source --watch -- ./run-my-app.sh Your app process will then be automatically restarted after the `envkey set` command with the latest postgres password in its environment. If you're running multiple instances, you could also use rolling restarts to avoid downtime. envkey-source --watch --rolling -- ./run-my-app.sh So it's a bit more work compared to Vault for the postgres use-case, but on the other hand, with EnvKey you get a lot of flexibility to setup these kinds of automations for any service or tool. For acting as a CA, we have some ideas on how to accomplish this that I think would be both simpler and more secure than Vault's approach, but we haven't gotten to it yet.

by 3np 3y ago

danenania 3y ago

Yeah, "easy integration" is more speaking to how you get secrets from Vault/EnvKey through to an app. Dynamic secrets generation isn't built in to EnvKey, but we do offer a CLI that makes it straightforward to generate or rotate credentials/roles as part of your deployment. Rather than baking in this kind of thing, we are more taking a 'give you simple building blocks so you can do anything' approach to automations. For your postgres example, it would look something like this: # Set variables for an EnvKey environment that includes postgres admin creds in shell eval $(envkey-source) # Use the admin credentials from EnvKey to rotate credentials for app role in Postgres. # You could also create new roles, grant privileges, etc., as needed. NEW_PASSWORD=$(openssl rand -base64 32) psql -h $DB_HOST -U $DB_ADMIN_USER -d $DATABASE_NAME -c "ALTER ROLE $ROLE_NAME WITH PASSWORD '$NEW_PASSWORD';" # Update the credentials in EnvKey for your app. envkey set app-name production DB_PASSWORD=$NEW_PASSWORD --commit --json Meanwhile, if you prefix your app start command like this: envkey-source --watch -- ./run-my-app.sh Your app process will then be automatically restarted after the `envkey set` command with the latest postgres password in its environment. If you're running multiple instances, you could also use rolling restarts to avoid downtime. envkey-source --watch --rolling -- ./run-my-app.sh So it's a bit more work compared to Vault for the postgres use-case, but on the other hand, with EnvKey you get a lot of flexibility to setup these kinds of automations for any service or tool. For acting as a CA, we have some ideas on how to accomplish this that I think would be both simpler and more secure than Vault's approach, but we haven't gotten to it yet.