Hacker News new | ask | show | jobs
by atarian 2230 days ago
Could this replace Vault?
3 comments

If your only use case for Vault is access to K/V secrets during a workflow (CD for example) -- then sure, it's a much simpler alternative. If you need access to secrets dynamically / at runtime (outside of the Actions container), or any of the other features Vault has, then no.
I’m not sure if you’re aware but the GitHub API provides dynamic access to the secrets so you can theoretically use it in your application/outside your workflow.
do you happen to have a link to the api docs for that? Everywhere I'm looking it doesn't return the value.

https://developer.github.com/v3/actions/secrets/#get-a-repos...

and the blog states the same behavior I'm seeing in the docs:

  First, the API doesn’t return any values, only names.
https://github.blog/2020-02-06-manage-secrets-and-more-with-...
No, you're right, I was mistaken. Sorry about that.
Not really. Vault offering is very extensive. Their product doesn't make much sense if all you were looking for was a simple deployment of your average amateur or small SaaS. Org and repositories secrets are simple security solutions for people who can't afford to use Vault.
It makes using org-level AppRoles with Vault really easy, but I wouldn't replace Vault with this. I use org contexts with CircleCI today to do this with a very generic AppRole that has access too 'secrets that should be in Vault, but are generally safe.' e.g.: a consul credential that can read/write from the terraform state area.