"This is a prototype. Do not use this in production."

Also, it's just a start; the existing "secrets" implementation needs to be completely scrapped in the name of security.

Adding integration of Vault into Secrets is an active discussion in sig-auth: https://github.com/kubernetes/kubernetes/issues/10439#issuec...

If you'd like to participate in these discussions, here are the details for the sig-auth's meetings & agenda items: https://github.com/kubernetes/community/tree/master/sig-auth

Thanks!

A prototype is a great way to get the conversation started. Most people don't even know why Vault should be considered, let alone why it's better than K8s secrets (which in their world works fine).

I agree, it's a start.

At its core, I'm having some difficulty wrapping my brain around the idea that any organization that's large and complex enough to demand to run their own compute platform (e.g. K8S) isn't also large and complex enough to demand a secure configuration system by default.

Maybe that's the disconnect here. There are plenty of small orgs using kubernetes for the ease of use and portability

Fines are cheap. Engineering is expensive.

There's your answer. I don't like it any more than you do, but that's the world we live in.

It's not just fines; it's the potential loss of your certifications upon which customers condition their business. That's a Big Deal.