Hacker News Reader

Comment by bsamuels | Hacker News Reader

Here's to hoping there's finally a Hashicorp Vault competitor. It's shocking that the only mature option for runtime secret delivery is Vault after all these years.

Some companies have created 'competitors', but they aren't even remotely mature (google secrets manager, aws secret manager, etc)

View on HN

Vault is open source, it looks like 1Password Secrets is closed source. Not really comparable. Probably not aimed at the same people.

[I work for 1Password] 1Password is not competing with Vault. In fact we have very good relationships and mutual respect with HashiCorp on many levels.

Also Secret automation integrates (acts as a provider) with HC Vault[0]

0: https://github.com/1Password/vault-plugin-secrets-onepasswor...

We use EnvKey [0], it's far friendlier to use than Vault and very mature. My only dislike is the Electron based app, but I so rarely have to open it that I can live with it.

https://www.envkey.com

Still no option to self host.

The founder of Envkey claimed they were working hard on V2 and self hosting 1.5 years ago[0] so it’s anyone’s guess as to why that’s been delayed/isn’t happening.

[0] https://news.ycombinator.com/item?id=21226715

Hi, I can assure you that it’s very much still in the works! It’s taken much longer than we wanted or anticipated, as we’re addressing a lot more than just self-hosting (though that’s an important piece). But we’re on the home stretch. Stay tuned.

Also a big fan of EnvKey here. We used them for over a year but ended up moving to AWS parameter store as part of a wider migration. Ability to self-host could have helped us stay on there longer, we just didn't want external dependencies in such a critical path. But otherwise, it served us well with zero hiccups.

I've had good luck with Azure KeyVault.

Ditto. The managed service provider VS user assigned rbac was confusing at first, but now I am happy that I took the time to understand it. Also the azure clouds handling of vaulted passwords in log files from services like Logic apps) is absolutely bad ass.

> Also the azure clouds handling of vaulted passwords in log files from services like Logic apps) is absolutely bad ass.

This is particularly interesting to me. Is there a good doc page or blog post that you're aware of that covers these capabilities? I'm curious and would love to learn more.

KeyVault is ideal when combined with Managed Identities. I would not leverage any service that required a connection string to access a secret.

The two you mentioned have ingrained business reasons to only work with "their" ecosystem. You need someone from outside to have an incentive to work with all.

What are your criticisms of Google secrets manager? It works well for me, but it's the only one I've used so I don't know much about the competition.

By far the biggest missing control is you can't restrict access to google secrets manager by source CIDR.

There were a bunch of other smaller nitpicks, but that was the overwhelming reason last time I looked at it.

IAM policies are designed for this reason, not IP based access controls.

E.g. in AWS you can specify the source CIDR range in an IAM policy.

You also have options like https://www.doppler.com/.

Reply on news.ycombinator.com