I think there is a network effect to Vault that the more locks it can change the more people will use it and the more plugins will be added to it.
I think Vault is hard to use and we're thinking of integrating it in GitLab to give it a friendly UI [1].
0. https://www.vaultproject.io/docs/secrets/databases/index.htm...
You can use the "random" provider to generate secrets, the "tls" provider to generate certs and I also wrote a "secret" provider[1] to hold arbitrary secrets.
The best part is that it doesn't require to maintain a long-running process. For small shops it's a good upgrade over storing credentials in code or using git-crypt.
TLDR: Terraform should use Vault for storing secrets in state, but does not support it yet.
(it is occasionally unavoidable storing secrets in state due to resources orchestrated)
This is why saas is preferable in a lot of situations. If you're not great at ops and make bad decisions, hopefully the SAAS folks are better at this than you. If you're really good at ops and think a ton about this stuff, then running it yourself makes sense a lot of time. And yes with SAAS now you have lockin and other problems which has their own set of solutions you should make sure you are doing, like layers of abstraction.
Then you get into the self-fulfilling-infrastructure scenario. We're a vault shop, everyone use vault even for stuff that makes no sense to use vault for. Then rinse and repeat.
Or you get into the sunk cost fallacy with your ops team... "what will they do if we replace this with a SAAS", so you keep services around just to not fire people, not because they're the best solution anymore.
Lots of places to make bad decisions.
I'm pointing out the whole "just run my pod" thing with tfn, or kube, leads people to thinking they're installing a phone app, not a multi-host, multi-protocol piece of software.
We're in violent agreement. We're just disagreeing about what the average person assumes.
SOPS is fine, I was more referring to my implementation.
The reason my pipeline scales poorly is because it requires a full build and deployment cycle to update my dev / stg / prod configurations.
Also, if you store the encrypted files in our git repos as I do, you get constant merge conflicts and basically useless git history.
It is an extremely lazy implementation and literally the bare minimum I could do to get get my application configurations updating in my CI/CD stack.
For smaller orgs and projects, Mozilla Sops is really great:
https://github.com/mozilla/sops
It encrypts your secrets at rest using Google KMS, Amazon KMS, and various other cloud provider key services. You can then put those secrets into your code repository, cloud file storage, etc. and give your build pipeline a service account with the ability to decrypt the secret files.
Scales like crap, but is quick and dirty when you need it.