vault

This is, but is still limited by their license: https://github.com/hashicorp/vault

A reference CI/CD architecture with a 2466 line helm values.yaml, whew <https://github.com/DoD-Platform-One/bigbang/blob/3.5.1/chart...> I have no idea who would win in a fight between people with literal guns and IBM's legal team <https://repo1.dso.mil/big-bang/product/packages/vault/-/blob...> vs <https://github.com/hashicorp/vault/blob/v1.20.2/LICENSE>. I guess to their credit, they do say at the top "licensing is complicated" but then go on to cite the old actual open source license that no longer applies https://github.com/DoD-Platform-One/bigbang/blob/3.5.1/docs/...

I can imagine they could have used AI to analyze, describe and map out what exactly happens in the code. Then again, it's Go, following the flow of code and what exactly is being checked is pretty straightforward (see e.g. https://github.com/hashicorp/vault/blob/main/vault/request_h... which was mentioned in the article)

OpenBao’s development seems heavily reliant on a single person, compared to multiple frequent long-term commiters to Vault. Not sure if I’d feel comfortable switching from Vault to OpenBao! I tried linking directly to contributors for last 12 months, but you still have to select the time range manually from the dropdown :( OpenBao: https://github.com/openbao/openbao/graphs/contributors?from=... Vault: https://github.com/hashicorp/vault/graphs/contributors?from=...

The combination of paginated list (last release) and transactions (this release) are a wonderful improvement over HashiCorp Vault. They're already paying dividends with the potential to implement much-requested improvements to Vault like recursive keys (https://github.com/openbao/openbao/issues/549 -- in https://github.com/hashicorp/vault/issues/5275, the first-most upvoted issue), list filtering (https://github.com/openbao/openbao/issues/769 -- in https://github.com/hashicorp/vault/issues/5362, the fourth-most upvoted issue), and more.

I was curious about this and went sniffing around and it seems that their instance metadata[1] doesn't include anything that demonstrably associates the instance with Hetzner nor your specific account, making chain of custody ... tricky. The best work-around I could come up with (not having a Hetzner account to actually kick the tires upon) is that you could inject a private key that you control into the instances via cloud-init (or volume attachment) and then sign any subsequent JWT using it. For sure it would not meet all threat models, but wouldn't be nothing either. I was hoping there was some chain of custody through Vault[2] but until Hetzner implements ANY IAM primitives, I'm guessing it's going to be a non-starter since the instances themselves do not have any identity 1: https://docs.hetzner.cloud/#server-metadata 2: https://gith

> Bootstrapping a new system is checking in their ssh key and running a shell script. If it interests you, both major git hosts (and possibly all of them) have and endpoint to map a username to their already registered ssh keys: https://github.com/mdaniel.keys https://gitlab.com/mdaniel.keys It's one level of indirection away from "check in a public key" in that the user can rotate their own keys without needing git churn Also, and I recognize this is departing quite a bit from what you were describing, ssh key leases are absolutely awesome because it addresses the offboarding scenario much better than having to reconcile evicting those same keys: https://github.com/hashicorp/vault/blob/v1.12.11/website/con... and while digging up that link I also discovered that Vault will allegedly do single-use passwords, too <https://github.com/hashic

For software developers, `asdf`[0] and dockerized projects goes a long way. For provisioning the environment variables needed for development, HashiCorp's `vault`[1] can make that pretty simple. Combine that with `direnv` to have it load the value dynamically with: ``` # .envrc API_KEY=$(vault kv get -field=API_KEY secret/projectA/dev) ``` I also wanted to experiment using `pass`[2] instead, but messing with GPG keyrings and the like is unwieldy and not too user-friendly. It's what I use for personal projects since Vault is overkill. [0] https://github.com/asdf-vm/asdf [1] https://github.com/hashicorp/vault [2] https://www.passwordstore.org/

What advantages over say, smallstep/certificates, letsencrypt/boulder, django-ca, square/certstrap, or hashicorp/vault (and e.g. OpenWRT's luci-app-acme ACMEv2 GUI) does Anchor offer? https://github.com/topics/acme applications/luci-app-acme/htdocs/luci-static/resources/view/acme.js: https://github.com/openwrt/luci/blob/master/applications/luc... https://openwrt.org/docs/guide-user/services/tls/acmesh https://developer.hashicorp.com/vault/tutorials/secrets-mana... https://github.com/hashicorp/vault : > Refer to Build Certificate Authority (CA) in Vault with an offline Root for an example of using a root CA external to Vault.

If anyone does start an open Vault fork, I'd be interested in contributing as I get time. Edit to add: https://github.com/hashicorp/vault/graphs/contributors?from=...

The author of this tool basically took the Shamir code from Hashicorp Vault, which is pretty mainstream. If you're looking for a solid implementation, I would start there[0]. I wouldn't use the Shamir code from this repo, as it's an old version of the vault code using field arithmetic that doesn't run in constant time. [0]: https://github.com/hashicorp/vault/blob/main/shamir/shamir.g...

Vault is under the BSL now too: https://github.com/hashicorp/vault/blob/main/LICENSE

Out of curiosity, what do you mean by this? cross-cluster? they already have HA: https://github.com/hashicorp/vault/blob/v1.14.1/website/cont... while digging up that link, I also saw one named replication: https://github.com/hashicorp/vault/blob/v1.14.1/website/cont...

https://github.com/hashicorp/vault/blob/main/LICENSE#L8-L11 Clearly states that you can use it in a production setup.

Maybe we'll see the whole team at [Axiom](https://github.com/hashicorp/vault/blob/0b12cdcfd17278d7cca2...) riding around in Maseratis.