Would we have a community supported and completely open-source secrets
manager for Kubernetes just like what happened with OpenTofu?
reddit / selfhosted

----------------------------------------------------------------------
m-noureldin · 2023-11-07 22:25

After HashiCorp changed the license of Terraform, we saw the
communicty forked it and started developing OpenTofu. Which is 100%
open-source. Is there  / Will be any similar move in this direction
for Kubernetes secrets management?

I am aware of some existing solutions, but all of them advertise
themselves as "open-source", while half of the features are closed and
EE only.

----------------------------------------------------------------------
reflectionism · 2023-11-07 23:44

This is needed. Using Vault in your stack is a License Risk. I've been
scouring the net for weeks for answers.

Keywhiz is dead, but there are a few other options under the cncf:
[https://landscape.cncf.io/card-mode?category=key-
management&grouping=category](https://landscape.cncf.io/card-
mode?category=key-management&grouping=category)
*(beware: some of those options are very robust but extra
complicated)*
Depending on your security posture you could manage using a "sealed
secret" approach:
[https://about.gitlab.com/blog/2021/12/02/gitops-with-gitlab-secrets-
management/](https://about.gitlab.com/blog/2021/12/02/gitops-with-
gitlab-secrets-management/)

https://github.com/bitnami-labs/sealed-secrets

----------------------------------------------------------------------
onedr0p · 2023-11-08 00:23

Have you checked out https://infisical.com/ ?

----------------------------------------------------------------------
m-noureldin · 2023-11-08 01:51

I did not want to mention software by itself, but this one also is
advertised as open source, while you need to pay to get a bunch of
should-have features.

----------------------------------------------------------------------
m-noureldin · 2023-11-08 01:56

Thank you for the links,

I am aware of GitOps secret management. I meant Vault (or any
similars) particularly.

It should be quire safe to use any older version of Vault that is
licensed under MSL. However, you will be stuck and get no new patches
or features, of course.

That is why I am asking if there is any plans to fork it or recreate
any real open source alternative, just as done with OpenTofu.

I guess I am not the only one who hit this limitation after HashiCorp
changed their license. Probably the issue is still quite new.

----------------------------------------------------------------------
crispychickentaco · 2023-11-08 04:32

I realize this isn't a completely open source solution, but I'm using
external-secrets with 1password-connect. Maybe there is a good
provider option here for you?


https://external-secrets.io/latest/provider/1password-automation/

----------------------------------------------------------------------
Shot-Bag-9219 · 2023-11-08 16:19

I'd recommend to check out Infisical too: https://infisical.com

----------------------------------------------------------------------
eclecticbit · 2023-11-08 23:20

Mozilla SOPS is how I manage secrets

https://github.com/getsops/sops

----------------------------------------------------------------------
m-noureldin · 2023-11-09 22:38

I checked it a couple of weeks ago. Though I liked how Infisical looks
and how it works, it is also advertised as open source, while you need
to pay to get a bunch of should-have features.