Vault VS sops

Cloud platforms provide tools like AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager for exactly this purpose. These services, which evolved from patterns Mitchell Hashimoto pioneered with Vault in 2015, store and encrypt your configuration.

Secure Secrets: Consider using Terraform’s Sensitive Variables or integrating with secret management tools like AWS Secrets Manager or HashiCorp Vault.

OpenTofu, (forked from Hashicorp Terraform), is a newer example along with OpenBao (forked from Hashicorp Vault). When HashiCorp changed the license for Terraform and Vault to the Business Source License (BSL), the community quickly responded by forking the project under the name OpenTofu & OpenBao. These forks aim to preserve the tool’s open nature and ensure that the developer community has a truly open source alternative to some of the industries widely adapted softwares.

When designing a Go project, look to real-world examples like Kubernetes, Vault and the Golang Standards Project Layout. These showcase how powerful Go can be when the architecture embraces simplicity over rigid structure. Rather than trying to make Go fit a Clean Architecture mold, embrace an architecture that’s as straightforward and efficient as Go itself. This way, you’re building a codebase that’s not only idiomatic but one that’s easier to understand, maintain, and scale.

> Bootstrapping a new system is checking in their ssh key and running a shell script.

If it interests you, both major git hosts (and possibly all of them) have and endpoint to map a username to their already registered ssh keys: https://github.com/mdaniel.keys https://gitlab.com/mdaniel.keys

It's one level of indirection away from "check in a public key" in that the user can rotate their own keys without needing git churn

Also, and I recognize this is departing quite a bit from what you were describing, ssh key leases are absolutely awesome because it addresses the offboarding scenario much better than having to negatively reconcile evicting those same keys: https://github.com/hashicorp/vault/blob/v1.12.11/website/con... and while digging up that link I also discovered that Vault will allegedly do single-use passwords, too <https://github.com/hashicorp/vault/blob/v1.12.11/website/con...>, but since I am firmly in the "PasswordLogin no" camp, caveat emptor with that one

HashiCorp Vault is a powerful tool designed for securely managing secrets and protecting sensitive data. It provides a unified interface to access secrets and protect sensitive data using a variety of methods such as encryption, access control, and dynamic secrets generation. Vault is widely used in modern infrastructure to ensure that sensitive information, like API keys, passwords, and certificates, is handled securely and accessed only by authorized entities. This guide aims to walk you through the process of deploying a production-ready HashiCorp Vault server on an AWS EC2 instance. The goal is to help you set up a secure, highly available, and scalable Vault environment that meets the needs of a production system.

Vault - For service authentication and key management.

This is a sample project to initialise a HashiCorp Vault instance with a PKI Instance and generate some secrets that can be used by the ForgerRock Identity Platform.

I have been working with YugabyteDB for a while now. I am always experiment with yugbayte + (something). Today, its Vault.

How does this compare to mozilla's sops[1]. I've heard sops is also used for this kind of usecase, although it seems to do much more.

[1] https://github.com/getsops/sops

You can also do some nice things with https://github.com/getsops/sops, I store encrypted password and secrets on git with sops, but I also use nix so I have near perfect integration with my services.

SOPS is a simple, yet powerful tool for managing secrets. It consumes a clear secret file in various formats and encrypts values using keys. The encrypted file can be then stored in a version control system and decrypted when needed.

There's also sops: https://github.com/getsops/sops

I've used it at two jobs now over about 5 years and have had zero issues.

My script just sets up default .sops.yaml for https://github.com/getsops/sops

You can further edit .sops.yaml(eg have multiple of them) and decide how you split secrets in your directory tree to further customize who can decrypt the secrets.

It works pretty well for prod/dev splits, etc

Mozilla SOPS (Secrets OPerationS) is an open-source command-line tool for managing and storing secrets. It uses secure encryption methods to encrypt secrets at rest and decrypt them at runtime. SOPS supports a variety of key management systems, including AWS KMS, GCP KMS, Azure Key Vault, and PGP. It's particularly useful in a DevOps context where sensitive data like API keys, passwords, or certificates need to be securely managed and seamlessly integrated into application workflows.

Encrypted secrets thanks to SOPS and Age

We do the exact same thing to keep track of some credentials we use sops[1] and AWS KMS to separate credentials by sensitivity, then use the git differ to view the diffs between the encrypted secrets

Definitely not best practice security-wise, but it works well

[1] https://github.com/getsops/sops

For anyone new to SOPS like I was - https://github.com/getsops/sops