HashiCorp and Google: easing secret and infrastructure management

Re:HashiCorp and Google: easing secret and infrastructure ma... by lolbrish on Tuesday September 19, 2017 @01:55PM (#15287022)

I unseal using ansible (with the unseal keys in ansible-vault) and automate the configuration fully through ansible. For example you can use the ansible expect module:

  - name: unseal 1
    expect:
      command: '/usr/bin/vault unseal'
      responses:
        'Key \(will be hidden\): ': "{{vault_seal_key_1}}"
      echo: yes
    when: vault_sealed_result.rc == 2 and vault_seal_key_1 is defined
    tags:
      unseal

[ Parent | on HN ]

Re:HashiCorp and Google: easing secret and infrastructure ma... by bogomipz on Wednesday September 20, 2017 @11:35AM (#15294911)

I'm interested in your solution, you are using ansible-vault to store the Hashicorp Vault unseal key(s)? Isn't this just pushing the problem out another level or am I missing something? Thanks.

[ Parent | on HN ]