Cons
- Team management is hard
- add team members
- delete team members
- Remembering to re-encrypt is hard
- Obscure encrypted file format
- Copy paste values from Terraform
Slide 22
Slide 22 text
git-crypt
Slide 23
Slide 23 text
No content
Slide 24
Slide 24 text
No content
Slide 25
Slide 25 text
No content
Slide 26
Slide 26 text
No content
Slide 27
Slide 27 text
No content
Slide 28
Slide 28 text
$ git-crypt unlock
Slide 29
Slide 29 text
No content
Slide 30
Slide 30 text
Cons
- Team management is still hard
- Obscure encrypted file format
- Copy paste values from Terraform
Pros
- Encryption is done automatically
Slide 31
Slide 31 text
Sealed Secrets
Slide 32
Slide 32 text
No content
Slide 33
Slide 33 text
No content
Slide 34
Slide 34 text
No content
Slide 35
Slide 35 text
No content
Slide 36
Slide 36 text
Cons
- Copy paste values from Terraform
- Manually encrypt values
- Need access to the cluster to encrypt
Pros
- Access is taken care of through the k8s cluster
- Readable files
Slide 37
Slide 37 text
No content
Slide 38
Slide 38 text
Dynamic Secrets
Slide 39
Slide 39 text
Terraform Kubernetes Provider
Slide 40
Slide 40 text
No content
Slide 41
Slide 41 text
No content
Slide 42
Slide 42 text
Cons
- Setup might be tricky
- Spin up k8s and then immediately use it
- Limited to Terraform secrets
Pros
- Secrets are automatically injected
Slide 43
Slide 43 text
Hashicorp Vault
Slide 44
Slide 44 text
No content
Slide 45
Slide 45 text
No content
Slide 46
Slide 46 text
No content
Slide 47
Slide 47 text
Cons
- Need to add extra setup
- envconsul
- application code
Pros
- Great Vault features
- Custom integrations
- Temporary credentials
- Rotation
- RBAC
- Can store external credentials
- Vault Operator!
Slide 48
Slide 48 text
Manifold Credentials Controller
Slide 49
Slide 49 text
No content
Slide 50
Slide 50 text
No content
Slide 51
Slide 51 text
No content
Slide 52
Slide 52 text
No content
Slide 53
Slide 53 text
No content
Slide 54
Slide 54 text
No content
Slide 55
Slide 55 text
Cons
- No one off passwords/temporary keys
Pros
- Still using the 12factor methodology
- Can connect with external services
- RBAC at service level
Slide 56
Slide 56 text
Reminders
- Encryption
- secrets
- etcd
- remote state
- RBAC for secrets
- Figure out what you need