3 ms·
My initial Ops gut feeling says "This is as lock in and error prone as Application Vault Libraries" but if Dev wanted to propose this, I'd be willing to see it
by stackskipton 1y ago
My initial Ops gut feeling says "This is as lock in and error prone as Application Vault Libraries" but if Dev wanted to propose this, I'd be willing to see it in real operation.
- 1718627440 1y agoIt isn't lock in, because all the application depends on is that it gets a string it can pass to exec/the shell and then reads all data from stdout until EOF as the secret.
- stackskipton 1y agoSure, but let's say you have 5 secrets to get or maybe the new vault CLI does not support just stdout printing but prints JSON only. I still think this is worse than config file/Env Vars.
- 1718627440 1y agoYou can always pass echo "SECRET" as the command, so it is a strict superset of the config file. Also programs that tend to provide a command option also tend to provide a simple string option.