Hacker News Reader

Comment by dijit | Hacker News Reader

Hashicorp vault is basically industry standard I believe. But there are various cloud APIs too, which have varying degrees of integration with kubernetes.

View on HN

I wish this wasnt the case. An open core product shouldn't be the industry standard as it's not truly open source (I doubt HashiCorp would allow a PR that brings enterprise functionality to open core) and the open core/give it away for free model stiffes competition (see Vaults pricing for an example, they know they own the market).

How is open core not truly open source? Of course they wouldn't accept a pull request that makes their pay product obsolete. But open source does not dictate that you must accept all pull requests.

There is nothing stopping you from forking the project and adding all the enterprise functionality you want.

https://github.com/hashicorp/vault/blob/master/LICENSE

Vault is also operationally complex and does a lot more than you need most of the time.

(shameless plug) For simple secret management use cases here is an alternative, "gitops" friendly, low "config footprint" tool: https://github.com/bitnami-labs/sealed-secrets

We have been trying to simplify Vault + Kubernetes integration in our KubeVault project. https://github.com/kubevault . I would love to hear if you have any thoughts.

Unfortunately Vault doesn't have a plugin yet for Docker Swarm still :(

Swarm is on its way out. Mirantis bought that part of Docker and they said this:

"The primary orchestrator going forward is Kubernetes. Mirantis is committed to providing an excellent experience to all Docker Enterprise platform customers and currently expects to support Swarm for at least two years, depending on customer input into the roadmap. Mirantis is also evaluating options for making the transition to Kubernetes easier for Swarm users."

https://www.mirantis.com/blog/mirantis-acquires-docker-enter...

This is sad. Swarm is simple and effective, like Nomad but easier.

Agreed. I’ve been working a lot with Swarm over the past year and while it’s not perfect, it has been an overall great experience. I really enjoy the simplicity and tight integration with Docker, and I feel that the ecosystem around Swarm was just starting to mature. Hopefully it remains an option for a while.

Also, I haven’t needed to integrate something like Vault because the Swarm secrets feature covers my use case perfectly.

I'm also using the secrets feature but it's very brittle. If your swarm gets destroyed or you want to migrate servers, it's a huge pain to get those secrets back up and running. Unless I'm missing a better way to do this, I'd love to know!

I currently have my secrets stored in an encrypted text file in case I need to bring them back up.

I do something similar, using Ansible Vault (not to be confused with Hashicorp Vault!) to store the encrypted secrets in my ops directory (separate from the application source code). They’re stored as YAML so very easy to upload/regenerate with Ansible.

But there's no money in enterprise support contracts for things which are simple and effective.

I feel like so much in the cloud space is actually getting worse because of this. Its like all the old server shufflers and netops guys have taken over.

Since Swarm is Open Source, it is possible the community will maintain it even after Mirantis/Docker have stopped developing it completely.

But is Swarm a valuable target? My feeling is that Swarm is going to be EOL'ed in not a so distant future.

Reply on news.ycombinator.com