Would love to see support for Vault's transit backend as the encryption key authority!
sixfeetover
All 12 comments
Are any of the core team able to provide some pointers on how this should be implemented. My team might be able to take a stab at this if we can get some help.
benlangfeld
on 5 Apr 2018
Sure! Depending on what you want, you either have to implement the Cipher interface (see example) or the MasterKey interface (see example). The former would make Vault an alternative for AES, whereas the latter would make it an alternative for GPG/KMS. Is this enough to get you started?
autrilla
on 6 Apr 2018
Has there been any further work on this issue?
Just-Insane
on 13 Mar 2019
The core team isn't working on this feature but we'd happily review and merge a patch from a motivated contributor.
jvehent
on 13 Mar 2019
Good idea! Any progress with it?
binlab
on 15 Mar 2020
No, I built Helm-Vault instead.
Just-Insane
on 15 Mar 2020
As I see this implementation almost done - https://github.com/mozilla/sops/pull/623
binlab
on 15 Mar 2020
Looks like it's already implemented and merged https://github.com/mozilla/sops/pull/655. The question is when is it going to be released?
smnbbrv
on 3 Jun 2020
This appears to just use Vault as a KMS storage area for your encryption keys, and does not actually store your secret values in Vault (which may be the preferred method for some).
Just-Insane
on 3 Jun 2020
This appears to just use Vault as a KMS storage area for your encryption keys, and does not actually store your secret values in Vault (which may be the preferred method for some).
Yes, sops publish does what you want instead
autrilla
on 3 Jun 2020
Link to the documentation on sops publish?
Just-Insane
on 3 Jun 2020
Link to the documentation on sops publish?
https://github.com/mozilla/sops/blob/master/README.rst#2171publishing-to-vault
autrilla
on 3 Jun 2020
Related issues
nphmuller
路
5Comments
naadev
路
6Comments
b-meson
路
6Comments
foray1010
路
7Comments
slukes
路
6Comments
Most helpful comment
Sure! Depending on what you want, you either have to implement the Cipher interface (see example) or the MasterKey interface (see example). The former would make Vault an alternative for AES, whereas the latter would make it an alternative for GPG/KMS. Is this enough to get you started?