Oliver Bertuch (Jun 13 2026 at 08:22): Oliver Bertuch (Jun 13 2026 at 08:22):This might be slightly of topic here, sorry. Feel free to move elsewhere or delete.
Running our installation on premises, I need to secure secrets better. Especially when it comes to CI/CD workflows, but potentially also for regular rotation of secrets in services.
A while ago I had a look at Vault, but they more or less require a paid Enterprise license for serious stuff. Lately I discovered OpenBao, a fork of community fork of Vault. As a now OpenSSF project, they got some fjndknf and are using Linux Foundation's Zulip.
The beat part: they support Hardware Security Modules (HSM) to auto-unseal the vault out of the box, no license needed! With their recent developments, soon to be released as v2.6.0, you can even use cheap Yubikeys as a simple makeshift HSM to secure the vault's root key!
I did some experimental stuff yesterday (yes, as a hobby): https://github.com/openbao/go-kms-wrapping/issues/55#issuecomment-4697143715
My plan: I'll use three Raspberry Pi in a 19" rack case and three Yubikeys to create a secure vault!
Oliver Bertuch (Jun 13 2026 at 08:28):They also have community PRs for supporting Openstack Barbican and some EU cloud provider's KMS.
Thomas van Erven (Jun 15 2026 at 07:48):I've recently taken to encoding with age and commiting the encrypted file, an decrypting as part of the pipeline.
Oliver Bertuch (Jun 15 2026 at 08:12):Absolutely! That is a splendid idea and it works very well.
I'm using the same at the moment to commit the unlock key to a Vaultwarden instance, used by External Secrets Operator. As I am using FluxCD, reusing their native Mozilla SOPS integration to decrypt using age is making this easy.
Unfortunately, this still doesn't solve one problem: where do you store the age private key the pipeline needs for decryption? In your case, it might be a part of your CI config. But can you really trust this to be a safe place? Long term storage of something that if leaked is THE crucial piece to get access to your entire infrastructure?
This is where KMS tools start to shine: you keep this stuff encrypted in a safe place and start using short lived, easily rotatable secrets. Maybe to retrieve bigger secrets, maybe to do something else.
Thomas van Erven (Jun 15 2026 at 11:04):I suppose if I was using gitops, I'd consider something like SOPS or so and a native Kubernetes secrets. Agreed that ESO is probably the right way to go, however (or rather a valid one depending on your use case - as with many things, it depends).
Regarding 'where does one host credentials and who do you trust at all' - I see you are a man with a can opener, in a room with lots of canned worms : D
Thomas van Erven (Jun 15 2026 at 11:07):https://www.youtube.com/watch?v=aGCdLKXNF3w (Everybody wants to rule the world)
Oliver Bertuch (Jun 15 2026 at 11:10):sops is not tied to ESO or Flux at all. It's a standalone tool they are reusing/integrating. It's great to handle your encryption with age (or other tools it supports) more automated. Might be worth checking out even if you're not into GitOps.
Oliver Bertuch (Jun 15 2026 at 11:11):Opening cans with worms is my specialty! I just discovered the whole world of Kata Containers and Confidential Containers. :see_no_evil:
Thomas van Erven (Jun 15 2026 at 11:30):(On the note of trust - I'm using a German based provider which is a strict EU-only entity for a reason)
Thomas van Erven (Jun 15 2026 at 11:32):And I think the best reality check is that none of us are that interesting (to my knowledge). I'm sure hackers/state services are tremendously impressed with my albums of cats.
Oliver Bertuch (Jun 15 2026 at 11:36):I beg to differ. We've seen Dataverse instances get hacked. I bet we'll see AI-backed bot armies soon. We can't just sit back.
Oliver Bertuch (Jun 15 2026 at 11:37):If you're on a cloud provider, there is no excuse to not use their KMS systems.
Thomas van Erven (Jun 15 2026 at 12:01):I mean, there we completely agree. Professional services vs hobby projects require different level of paranoia.
Thomas van Erven (Jun 15 2026 at 12:02):Btw, let me know how your Pi experiment works out. I've got a spare one sitting on my desk which can be put to work.
Oliver Bertuch (Jun 15 2026 at 12:40):Thomas van Erven said:
Professional services vs hobby projects require different level of paranoia.
I couldn't agree more! :sweat_smile:
Last updated: Aug 18 2026 at 08:27 UTC