5 ms·
As much as I appreciate open source forks of things like this I’d rather just completely avoid vault if I can. This and consul are bits of software that make my
by baz00 3y ago
As much as I appreciate open source forks of things like this I’d rather just completely avoid vault if I can. This and consul are bits of software that make my life harder not better in the last few years.
- deleted 3y ago[deleted]
- szszrk 3y agoWhat are the alternatives to both that don't make your life harder? Curious if there are any.
- totallywrong 3y agoI just replaced a clunky secrets manager with Mozilla SOPS and secrets-in-code that we keep in git encrypted and can version like any other file. I like this approach better than any alternative I've used so far.
- szszrk 3y agoWell, that actually may be a good hint for me for a project I'm working on right now. I just fell of the chair when I realized how Vault charges for Enterprise "clients" (identities). This could be some fresh air.
- glitchcrab 3y agoTheir pricing was laughable when we investigated it a couple of years back; I imagine it's only gotten worse since. When I told them how ridiculously expensive it was for our use-case they suddenly managed to find a ~50% discount for us. That brought it down to just laughably expensive. Needless to say, we stuck with DIY.
- Sayrus 3y agoSOPS is only an alternative for vault KV Store. Even then, it requires a lot of manual plumbing when you have operators and Terraform pushing secrets or keys into Vault KV. To replace SSH Sign and Cert Authority or databases engines, both generating short-lived credentials on-demand, SOPS will not easily solve the issue. If you only need KV Store, SOPS experience is way better than Vault and maintenance cost is low.
- NewJazz 3y agoStep CA can do SSH CA.
- cvalka 3y agoSOPS + STEP + Teleport
- mdaniel 3y agoIn case you didn't see it: https://goteleport.com/blog/teleport-oss-switches-to-agpl-v3/ https://goteleport.com/blog/teleport-oss-switches-to-agpl-v3... and https://github.com/gravitational/teleport/pull/35259 https://github.com/gravitational/teleport/pull/35259 I readily admit it's not the same amount of :fu: as BuSL or whatever the fuck is going on over at Sentry but still :-( as compared to their much friendlier Apache 2
- vmatsiiako 3y agoCheck out Infisical: https://github.com/Infisical/infisical https://github.com/Infisical/infisical Disclaimer: I'm one of the founders
- szszrk 3y agoThanks, looks quite cool and a bit more in line with my Kubernetes setup than KeyEnv mentioned above. I'll give it a try, especially if I can start with self hosted opensource version when the team is still tiny. Looks well polished at first glance.
- danenania 3y agoCheck out EnvKey - https://envkey.com https://envkey.com (I’m the founder) It’s simple, has real client-side end-to-end encryption with no backdoors or compromises, is open source, and gives you a bunch of ways to manage and de-duplicate config. Comparison with Vault: https://www.envkey.com/compare/hashicorp-vault/ https://www.envkey.com/compare/hashicorp-vault/
- mike-cardwell 3y agoDoes envkey have a concept like Vaults secret engines? E.g Vault can automatically create temporary service accounts in AWS and GCP on demand. It can also create credentials in dbs like postgres on demand and rotate them. Also, can it be set up as a private CA and sign certs on demand?
- danenania 3y agoIt has a CLI that can be used for this purpose, but you would have to script it. It also doesn’t have private CA or cert generation features, so if you need that then perhaps Vault or OpenBao would be a better fit. Though if you wanted to use EnvKey for simplicity and security reasons, you could potentially do your cert generation with openssl or another tool and then store the certs in EnvKey. The featureset isn’t 1-to-1. EnvKey is more focused on config management and ease-of-use and not so much on slotting into more complex custom infra that needs eg a private CA. Though like I said it is quite flexible so you could make it fit into just about any system if you’re willing to do a bit of scripting.
- mike-cardwell 3y agoYour "Comparison with Vault" page is not a fair comparison. It pretends like 90% of Vaults functionality doesn't exist.
- danenania 3y agoCan you be more specific? It clearly mentions encryption-as-a-service and secrets generation as advantages of Vault, among others. The point of the comparison is not to have an itemized list of every feature, but to compare the most important features and tradeoffs at a high level. It includes the disclaimer that Vault could be better for some more complex use cases (as I have also done here in my reply to you).
- ATMLOTTOBEER 3y agoSeconding. Vault is annoying.
- jasonjayr 3y agoCurious about your take on consul -- it's been instrumental for service discovery in our non-K8S environment...
- baz00 3y agoHad three major cluster collapses. Elections that never worked out. Weird state inconsistency problems. I don’t sleep well any more. Never entrust consistent state to things based on arguments and opinions.
- konart 3y agoHarder how? My company has started using Vault a few months ago - seems pretty easy for me (store secret in vault, get it during gitlab's pipeline pass it as a kuber secret)