- Absolutely take an incremental approach, there is a learning curve
- Use a high availability backend. I started out with just consul, but have since went with consul for HA, and cockroachdb as the data store.
- Practice your disaster recovery a many times before you go all in
- use a combo of paper plus offline digital storage for the unseal keys and root tokens
- be diligent about roles/policies
- rely on tokens more than any other auth method(username/pass, certs)
- don’t be afraid to use many vault instances that can talk to a core instance for things like transit auto unseal
All that said, I absolutely think it’s worth the investment if you have the infrastructure to back it(aka a cluster without a SPOF)
The PKI backend is phenomenal, and it makes a great sidecar for any app that needs auth, secrets, or general crypto stuff using the transit backend.
I really want to create a user friendly Password Manager/TOTP front end backed by vault. Someday…
On a more general note, its taken us a long time to get comfortable with using Vault for increasingly critical things, and we are now at the point where it being down is extremely critical. But there are several components like this, and we are able to tolerate node failure, so its somewhat acceptable.
I'm hoping you get some replies, but I'm also thinking of a low risk approach first, specifically with temporary SSH keys and temporary DB credentials.
I am not saying that Vault makes leaks impossible; it is just that I trust their team a lot more than myself when it comes to building a secret management tool.
The one thing keeping me from adopting isn't that it won't be secure enough. I worry _constantly_ that I'll lock myself out of my data, my infrastructure, etc.
Have others had that worry? How'd you get over it and just start using Vault? (probably through incremental, low-risk adoption first?)