5 ms·

While the Nomad stack is a direct competitor to k8s, Consul and Vault are both heavily used alongside k8s. In fact, Consul had features that were only for k8s t

by twunde 3y ago

While the Nomad stack is a direct competitor to k8s, Consul and Vault are both heavily used alongside k8s. In fact, Consul had features that were only for k8s the last time I checked

busterarm 3y ago
[flagged]
- hdaz0017 3y ago
  There is a big difference though Terraform is the out and out winner in its market. All their other products are at best small x% share of a crowded market or dominated by another product.
  - ghshephard 3y ago
    Genuinely curious - other than Vault - what other product is there for secret management in the cloud infrastructure space. I get that CyberArk Conjur is big in the enterprise space, but I thought cloud users, even with k8s, mostly went with vault.
    - candiddevmike 3y ago
      Most companies are probably using the secret manager provided by their cloud platform instead of Vault, especially after they tried to buy Vault.
      - Alupis 3y ago
        Which is more than likely Vault + new carpets and paint.
        xyzzy_plugh 3y ago
        No, it's astronomically unlikely to be Vault at all.
        Alupis 3y ago
        It's far more likely to be Vault as a base, actually. The MPL would allow someone like Amazon to use Vault's source as a base, and so long as the core source wasn't modified Amazon would be under no obligation to make their modifications public. The MPL is a lot more "business" friendly than the GPL. The very fact that HashiCorp is changing their license and restricting use clearly indicates they see this threat as reality. Amazon/Microsoft/Google/Whoever using HashiCorp's work/effort but keeping all the money to themselves.
        candiddevmike 3y ago
        I don't know what you've heard but none of the cloud providers use HashiCorp Vault as the foundation for their secrets manager.
        xyzzy_plugh 3y ago
        Yes, they could, but no major cloud provider does. They're all bespoke. Read their white papers and it'll make more sense.
    - oneplane 3y ago
      You generally only run Vault if your secrets don't/won't/can't reside on a public cloud service.
      - Alupis 3y ago
        There's a lot more reasons to run Vault than those. Having a standardized way to "do secrets" for any team, any service, any app within the organization is very nice. Becoming cloud-agnostic for your secrets (connecting your local Vault with the cloud provider's vault) is another great benefit. Automatic secret rotation is also another great benefit. Secret versioning and auditing... etc. It's not just "can't have this secret in VCS or viewable via kubectl".
        oneplane 3y ago
        > It's not just "can't have this secret in VCS or viewable via kubectl". That is exactly what it is. You seem to misunderstand (and thus downvote?) the statement I made. I'm not saying "haha vault bad", I'm answering "what other product" (from ghshephard) with the reality of today. This has nothing to do with what Vault is or isn't, but just with the concept of storing secrets in a uniform way in clouds for use with cloud workloads what is being used right now.
        Alupis 3y ago
        I did not downvote you, no. Downvoting because we disagree isn't how that's supposed to work, even though some use it that way. Regardless, the use of Vault is not exclusive to cloud environments. All of the listed features of Vault have benefits within larger organizations even if they don't use the "cloud" and deploy monolithic applications. Most frameworks have built in ways to fetch secrets/config from Vault, making it an easy standardized way to do things across all of your applications/teams. It doesn't mean you need to use it, of course, but it has a lot of perks for many different situations.
        oneplane 3y ago
        I totally agree that Vault is more than a glorified password manager (because that's what most Clouds have in their implementation of a secrets store), but the thing is, everywhere I go, I don't see people use Vault, I see them use whatever AWS/Google/Azure happens to have (and often badly). I'm not sure if that's even what ghshephard meant when he was curious for 'products', since technically all those cloud-integrated services aren't really stand-alone products for that matter. In AWS for example, with or without EKS (and then something like External Secrets Operator in the EKS case), it's all just AWS Secrets Manager and sometimes Parameter Store. In a few cases people do manual encryption (using KMS), but in no case was HashiCorp Vault used. Often, it's even worse: no secrets management at all. Stuff just gets pumped into environment variables (more often than not they get committed as .env files to Git), and there's just no drive to change that, even when a business policy is in place. Some even 'work around' this by storing secrets in password managers like 1Password and LastPass so they can check the compliance box without actually protecting the secrets (since they also live in plain text in VCS and at runtime in the environment). In terms of 'products', I'd say Vault and the cloud ones don't really compare, but reality is depressing and secrets are often not as secret as the name implies. From a developer perspective, they might compare them because they desire the secrets to be injected into the environment either way, and as such the source doesn't matter much. I'm not sure if we should see that as a feature or a bug.
    - hdaz0017 3y ago
      HashiCorp Vault - is big in Secrets management but its not the Terraform of Secrets management it's just too easy to make another product. AWS Secrets Manager AWS Systems Manager Parameter Store AWS KMS Google Cloud KMS - Cloud Key Management System Azure Key Vault confidant - https://lyft.github.io/confidant https://lyft.github.io/confidant keywhiz - https://github.com/square/keywhiz https://github.com/square/keywhiz knox - https://github.com/pinterest/knox https://github.com/pinterest/knox strongboxsafe - https://strongboxsafe.com https://strongboxsafe.com conjur - https://www.conjur.org https://www.conjur.org + many more Ansible Vault - probably not competing directly I am pretty sure companies like netflix, facebook, uber, tesla and others are probably using their own in house creations.

by twunde 3y ago

While the Nomad stack is a direct competitor to k8s, Consul and Vault are both heavily used alongside k8s. In fact, Consul had features that were only for k8s the last time I checked

busterarm 3y ago

[flagged]

hdaz0017 3y ago
There is a big difference though Terraform is the out and out winner in its market. All their other products are at best small x% share of a crowded market or dominated by another product.
- ghshephard 3y ago
  Genuinely curious - other than Vault - what other product is there for secret management in the cloud infrastructure space. I get that CyberArk Conjur is big in the enterprise space, but I thought cloud users, even with k8s, mostly went with vault.
  - candiddevmike 3y ago
    Most companies are probably using the secret manager provided by their cloud platform instead of Vault, especially after they tried to buy Vault.
    - Alupis 3y ago
      Which is more than likely Vault + new carpets and paint.
      - xyzzy_plugh 3y ago
        No, it's astronomically unlikely to be Vault at all.
        Alupis 3y ago
        It's far more likely to be Vault as a base, actually. The MPL would allow someone like Amazon to use Vault's source as a base, and so long as the core source wasn't modified Amazon would be under no obligation to make their modifications public. The MPL is a lot more "business" friendly than the GPL. The very fact that HashiCorp is changing their license and restricting use clearly indicates they see this threat as reality. Amazon/Microsoft/Google/Whoever using HashiCorp's work/effort but keeping all the money to themselves.
        candiddevmike 3y ago
        I don't know what you've heard but none of the cloud providers use HashiCorp Vault as the foundation for their secrets manager.
        xyzzy_plugh 3y ago
        Yes, they could, but no major cloud provider does. They're all bespoke. Read their white papers and it'll make more sense.
  - oneplane 3y ago
    You generally only run Vault if your secrets don't/won't/can't reside on a public cloud service.
    - Alupis 3y ago
      There's a lot more reasons to run Vault than those. Having a standardized way to "do secrets" for any team, any service, any app within the organization is very nice. Becoming cloud-agnostic for your secrets (connecting your local Vault with the cloud provider's vault) is another great benefit. Automatic secret rotation is also another great benefit. Secret versioning and auditing... etc. It's not just "can't have this secret in VCS or viewable via kubectl".
      - oneplane 3y ago
        > It's not just "can't have this secret in VCS or viewable via kubectl". That is exactly what it is. You seem to misunderstand (and thus downvote?) the statement I made. I'm not saying "haha vault bad", I'm answering "what other product" (from ghshephard) with the reality of today. This has nothing to do with what Vault is or isn't, but just with the concept of storing secrets in a uniform way in clouds for use with cloud workloads what is being used right now.
        Alupis 3y ago
        I did not downvote you, no. Downvoting because we disagree isn't how that's supposed to work, even though some use it that way. Regardless, the use of Vault is not exclusive to cloud environments. All of the listed features of Vault have benefits within larger organizations even if they don't use the "cloud" and deploy monolithic applications. Most frameworks have built in ways to fetch secrets/config from Vault, making it an easy standardized way to do things across all of your applications/teams. It doesn't mean you need to use it, of course, but it has a lot of perks for many different situations.
        oneplane 3y ago
        I totally agree that Vault is more than a glorified password manager (because that's what most Clouds have in their implementation of a secrets store), but the thing is, everywhere I go, I don't see people use Vault, I see them use whatever AWS/Google/Azure happens to have (and often badly). I'm not sure if that's even what ghshephard meant when he was curious for 'products', since technically all those cloud-integrated services aren't really stand-alone products for that matter. In AWS for example, with or without EKS (and then something like External Secrets Operator in the EKS case), it's all just AWS Secrets Manager and sometimes Parameter Store. In a few cases people do manual encryption (using KMS), but in no case was HashiCorp Vault used. Often, it's even worse: no secrets management at all. Stuff just gets pumped into environment variables (more often than not they get committed as .env files to Git), and there's just no drive to change that, even when a business policy is in place. Some even 'work around' this by storing secrets in password managers like 1Password and LastPass so they can check the compliance box without actually protecting the secrets (since they also live in plain text in VCS and at runtime in the environment). In terms of 'products', I'd say Vault and the cloud ones don't really compare, but reality is depressing and secrets are often not as secret as the name implies. From a developer perspective, they might compare them because they desire the secrets to be injected into the environment either way, and as such the source doesn't matter much. I'm not sure if we should see that as a feature or a bug.
  - hdaz0017 3y ago
    HashiCorp Vault - is big in Secrets management but its not the Terraform of Secrets management it's just too easy to make another product. AWS Secrets Manager AWS Systems Manager Parameter Store AWS KMS Google Cloud KMS - Cloud Key Management System Azure Key Vault confidant - https://lyft.github.io/confidant https://lyft.github.io/confidant keywhiz - https://github.com/square/keywhiz https://github.com/square/keywhiz knox - https://github.com/pinterest/knox https://github.com/pinterest/knox strongboxsafe - https://strongboxsafe.com https://strongboxsafe.com conjur - https://www.conjur.org https://www.conjur.org + many more Ansible Vault - probably not competing directly I am pretty sure companies like netflix, facebook, uber, tesla and others are probably using their own in house creations.