vault-on-gke

One note on the security side of things -- if you're interested in seeing what a truly hardened k8s/GKE configuration looks like, check out the Vault examples: https://learn.hashicorp.com/vault/kubernetes/k8s-reference-a... https://github.com/sethvargo/vault-on-gke In summary, for your security-critical workloads you're going to want to put them in their own cluster; treat k8s in this case as an API for updating the code that's running on your VMs. (Except your VMs can run a stripped-down read-only OS like Container-OS or CoreOS).

You can use GCPKMS (probably AWS KMS too) to unseal Vault automatically. https://github.com/sethvargo/vault-on-gke/blob/master/terraf... The KMS ring itself is only accessible by Vault. People with high enough privileges for our Vault GCP project could technically grant themselves access to it, but on day-to-day business, nobody can view the project. At some other place, where we were using AWS, I wrote a script that would store encrypt unseal keys (need multiple due to shamir) via pgp using their keybase public key. IIRC you can store encrypted keys in Vault that can be accessed only for unsealing purposes (please correct me on this). When needing an unseal, the script on the user side would then decrypt the key and submit it to Vault for unsealing. It worked well enough, and it felt like being in the movie/game GoldenEye, but nowhere as

Your vault-on-gke[0] repo is solid. For greenfield GKE projects starting now, would you recommend Secret Manager or vault-on-gke? 0: https://github.com/sethvargo/vault-on-gke