Re:HashiCorp and Google: easing secret and infrastructure ma...
by gobengo on Tuesday September 19, 2017 @12:30PM
(#15286109)
Hesitant why? It's pretty darned good.
Kubernetes also has a Secret abstraction, but you probably don't want to start setting up Kubernetes just for secret storage. Vault is good at that.
[ Parent
| on HN ]
Re:HashiCorp and Google: easing secret and infrastructure ma...
by jaxxstorm on Tuesday September 19, 2017 @05:20PM
(#15288919)
kubernetes "secrets" are base64 encoded only, anyone with access to the resource can view the original secret.
Re:HashiCorp and Google: easing secret and infrastructure ma...
by jesseendahl on Tuesday September 19, 2017 @08:28PM
(#15289861)
The lack of encryption at rest for Kubernetes secrets was one of the (many) factors in why we originally chose Vault.
That said, there's been a lot progress recently in this area recently. Starting in Kubernetes 1.7, you can optionally encrypt etcd at rest: https://kubernetes.io/docs/tasks/administer-cluster/encrypt-...
You also have a few good choices for the crypto. Two of the choices are Secret Box (XSalsa20 + Poly1305) and AES-GCM with random nonce.
Full list of providers, including info on strength + other considerations:
https://kubernetes.io/docs/tasks/administer-cluster/encrypt-...