Open LucasSegersFabro opened 5 months ago
hi @LucasSegersFabro, we're considering it (others have requested it as well) but I also have some philosophical misgivings at the moment. Currently my raw thoughts are this:
.env.vault
is a great mechanism to securely pass secrets on any platform, framework, or infrastructure. afterall, it's just a file. so anywhere you can move files (which is everywhere), you can move your .env.vault file.env.vault
is just a file format standard, it can be implemented with any infra tool, etc in an agnostic way. it uses open cryptography standards.essentially, I'm currently hesitant to get into the kubernetes external secrets controller because I see it mainly as a mechanism to interact with non-open non-agnostic vaulting systems.
what if you just shipped your .env.vault file with your code on kube? and just set a single DOTENV_KEY env/secret in kube?
welcome all thoughts here. my thoughts are developing here and I really do not know kube well.
hey @motdotla , I completely understand
maybe you'd want a plug and play controller for a "premium tier", since it would poll from your servers if customers want it really hard
as for me things would work fine if I use the versioned file as the source of truth (given that we always remember to pull/commit it).
it would be easier still since we git-opts everything into the cluster
the only hassle would be that I'd need an environment with nodejs to use the cli (and decrypt the file). Maybe if it was shipped with static-linked binaries (like with golang) this would be a non-issue
feel free to close the issue if needed, since I can easily work around it also feel free to reach out if you need any pointers with kube :)
Hey!
I love dot-env vault and I was wondering if there are any considerations for an auto sync solution for a kubernetes cluster.
Main use case:
Something like external-secrets controller that has a well-stabilished API and implementations for different providers
Probably the controller would have to poll each configured secret for changes and pull them if needed, so maybe it's not something you'd want to enable for everyone at the same time (even though I guess that the majority of calls would be polling for the latest version)
Thanks :)