4 ms·

You can have sd and secrets with just nomad now, it is perfect for small projects in that way. K8s also can do secrets! base64 encoded secrets! But in case you

You can have sd and secrets with just nomad now, it is perfect for small projects in that way. K8s also can do secrets! base64 encoded secrets! But in case you need a more secure solution. Please pull in a Vault helm chart or mess around with sops or whatever. Want to scale out? See how long it will take you until you will have to move your etcd to dedicated hw/vm's. And let me tell you - setting up external etcd in prod sucks. Also maintaining mission control, because there is a bunch of ways to do things and devs love using things that they are not supposed to touch. Nomad approach is modular this is why it works. Need proper multi dc SD? please run a consul cluster (single binary + single config file)x3. Need mesh networking? same. Need secrets? Vault (single binary + single config file)x3. Pki? same. Or maybe you don't need it? Then you have an option to just not use it. One thing that i really don't like about it that there is not a lot of docs describing all the ways these tools can interact with each other.

ownagefool 3y ago
K8s supports encryption at rest, ACLs and audit logs. What it actually lacks is versioning, and a dynamic secrets engine, though you could build that with an operator, and things like the postgres-operator do. You also don't get the whole sealing thing, but I'd argue that's more annoying than useful.
- sleepybrett 3y ago
  > You also don't get the whole sealing thing, but I'd argue that's more annoying than useful. A-fucking-men.
- vosper 3y ago
  What's "sealing" in this context?
  - proxysna 3y ago
    Unsealing is the process of obtaining the plaintext root key necessary to read the decryption key to decrypt the data, allowing access to the Vault. Prior to unsealing, almost no operations are possible with Vault. For example authentication, managing the mount tables, etc. are all not possible. The only possible operations are to unseal the Vault and check the status of the seal. https://developer.hashicorp.com/vault/docs/concepts/seal https://developer.hashicorp.com/vault/docs/concepts/seal

ownagefool 3y ago

K8s supports encryption at rest, ACLs and audit logs. What it actually lacks is versioning, and a dynamic secrets engine, though you could build that with an operator, and things like the postgres-operator do. You also don't get the whole sealing thing, but I'd argue that's more annoying than useful.

sleepybrett 3y ago
> You also don't get the whole sealing thing, but I'd argue that's more annoying than useful. A-fucking-men.
vosper 3y ago
What's "sealing" in this context?
- proxysna 3y ago
  Unsealing is the process of obtaining the plaintext root key necessary to read the decryption key to decrypt the data, allowing access to the Vault. Prior to unsealing, almost no operations are possible with Vault. For example authentication, managing the mount tables, etc. are all not possible. The only possible operations are to unseal the Vault and check the status of the seal. https://developer.hashicorp.com/vault/docs/concepts/seal https://developer.hashicorp.com/vault/docs/concepts/seal