Hey! So I’ve been part of a team developing an open source tool for capturing as much data as possible to do with software development/release (test results, task management, ci pipelines, etc.). It is basically a data pipeline language in HCL with a graphql backend for data storing, querying, mutation, subscribing, notifications... At least I am super excited about this project, codenamed “bubbly”
Andrey suggested that we could do an episode on this, and discuss similar tools like Eiffel or even tekton.
Thoughts_
12 replies
@veggiemonk this one is better https://github.com/external-secrets/kubernetes-external-secrets
1 reply
Support not only vault but AWS Secrets Manager as well
though useful for GitOps approach I wouldn’t pull secrets from Vault to k8s secrets since then auditing becomes harder
it is better to have application to read it directly from vault (or using some startup script)
making sure we have a tracable access log wiht actual id
I use this for getting vault secrets to my pods
official mutating webhook from HashiCorp
Well the pod has access to pull it so you can curl and get the secret from the pod 😂
In linux everything is a file
though you need a root or sudo to read that one
not sure if the same user can read one of its processes environ
Life happens
Talking about Chaos Engineering, I've done a few talk about it: One of the earliest is https://www.youtube.com/watch?v=ukc5mvZkxDI with Sylvain (author of Chaos Toolkit)
will add it to the show notes
Hi. Me and Jonas (a colleague) are creating an open source tool on GitHub. Mostly to try and set s proper project up, and because a customer of ours need it. Its done in our free time, and we would love some feedback. It's still work in progress, but the major functionality is more or less in place.
https://github.com/jonasvinther/medusa
If you have time, let us know what you think vault experts 🤓
If you have time, let us know what you think vault experts 🤓
just trying to understand what is it for
Import and export of data. Recursively. So yaml or JSON becomes the format that defines your vault data, also as an backup. We will add the possibility to encrypt the output later on, but you can just pipe it to PGP or alike. Also you can export a section of your data, and import that to another vault. Or to the same vault in a different place.
One immediate use case I can see: when creating the infra where Vault will run (so you don’t have vault yet) it would be cool to spin up a temp vault instance that can be bootstrapped in this way, but used with packer/terraform/etc more as an API than long term secrets storage
So such script would be useful for people runnung on prem
but usually people wiht infra on prem has money to spend and they might already have Vault Enterprise
but if they don’t then it might be legit case for them
Everyone has the same problem and solve it..