9 ms·

Hashi never sold me on the integration of their products, which was my primary issue with not selecting them. Each is independently useful, and there is no nudg

Hashi never sold me on the integration of their products, which was my primary issue with not selecting them. Each is independently useful, and there is no nudge to combine them for a 1+1=3 feature set. Kubernetes was the chasm. Owning the computing platform is the core of utilizing Vault and integrating it. The primary issue was that there was never a "One Click" way to create an environment using Vagarent, Packer, Nomad, Vault, Waypoint, and Boundry for a local developer-to-prod setup. Because of this, everyone built bespoke, and each component was independently debated and selected. They could have standardized a pipeline and allowed new companies to get off the ground quickly. Existing companies could still pick and choose their pieces. On both, you sell support contracts. I hope they do well at IBM. Their cloud services' strategy is creating a holistic platform. So, there is still a chance Hashi products will get the integration they deserve.

JohnMakin 2y ago
I was an extremely early user and owner of a very large-scale Vault deployment on Kubernetes. Worked with a few of their sales engineers closely on it - was always told early on that although they supported vault on kubernetes via a helm chart, they did not recommend using it on anything but EC2 instances (because of "security" which never really made sense their reasoning). During every meeting and conference I'd ask about Kubernetes support, gave many suggestions, feedback, showed the problems we encountered - don't know if the rep was blowing smoke up my ass but a few times he told me that we were doing things they hadn't thought of yet. Fast forward several years, I saw a little while ago that they don't recommend the only method of vault running on EC2, fully support kubernetes, and I saw several of my ideas/feedback listed almost verbatim in the documentation I saw (note, I am not accusing them of plagiarism - these were very obvious complaints that I'm sure I wasn't the only one raising after a while). It always surprised me how these conversations went. "Well we don't really recommend kubernetes so we won't support (feature)." Me: "Well the majority of your customers will want to use it this way, so....." Just was a very frustrating process, and a frustrating product - I love what it does, but there are an unbelievable amount of footguns laden in the enterprise version, not to mention it has a way of worming itself irrevocably into your infrastructure, and due to extremely weird/obfuscated pricing models I'm fairly certain people are waking up to surprise bills nowadays. They also rug pulled some OSS features, particularly MFA login, which kind of pissed me off. The product (in my view) is pretty much worthless to a company without that.
- neurostimulant 2y ago
  They probably don't want their customers to use a competitor's product instead of Nomad.
- JojoFatsani 2y ago
  (I have no idea what your infra is so don’t take this as prescriptive) My feeling is that for the average company operating in a (single) cloud, there’s no reason to use vault when you can just used AWS Secret Manager or the equivalent in azure or GCE and not have to worry about fucking Etcd quorums and so forth. Just make simple api calls with the IAM creds you already have.
  - JohnMakin 2y ago
    ime that’s a way better product to use for secrets management unless you’re trying to do very advanced CA stuff.
  - elzbardico 2y ago
    This^ Unless you're a hybrid/multiple cloud environment, there's no much point in using Vault.
  - leetrout 2y ago
    Caveat: the HCP hosted vault is reasonably priced and works well. However, strong agree on using your home cloud's service. We used Vault with Heroku and were happy.
    - candiddevmike 2y ago
      > Caveat: the HCP hosted vault is reasonably priced and works well. HCP hosted Vault starts at ~$1200/month, you'd have to use a metric shit ton of secrets in AWS or GCP to come close to that amount. Yes Vault does more than just secrets, but claiming anything HC sells as reasonably priced is a reach.
      - leetrout 2y ago
downrightmike 2y ago
We really need a 2.0 version that actually delivers the promise these tools never reached because legacy decisions
candiddevmike 2y ago
FWIW, "HashiStack" was a much discussed, much promised, but never delivered thing. I think the way HashiCorp siloed their products into mini-fiefdoms (see interactions between the Vault and Terraform teams over the Terraform Vault provider) prevented a lot of cross-product integration, which is ironic for how "anti-silo" their go to market is. There's probably an alternate reality where something like HashiStack became this generation's vSphere, and HashiCorp stayed independent and profitable.

JohnMakin 2y ago

I was an extremely early user and owner of a very large-scale Vault deployment on Kubernetes. Worked with a few of their sales engineers closely on it - was always told early on that although they supported vault on kubernetes via a helm chart, they did not recommend using it on anything but EC2 instances (because of "security" which never really made sense their reasoning). During every meeting and conference I'd ask about Kubernetes support, gave many suggestions, feedback, showed the problems we encountered - don't know if the rep was blowing smoke up my ass but a few times he told me that we were doing things they hadn't thought of yet. Fast forward several years, I saw a little while ago that they don't recommend the only method of vault running on EC2, fully support kubernetes, and I saw several of my ideas/feedback listed almost verbatim in the documentation I saw (note, I am not accusing them of plagiarism - these were very obvious complaints that I'm sure I wasn't the only one raising after a while). It always surprised me how these conversations went. "Well we don't really recommend kubernetes so we won't support (feature)." Me: "Well the majority of your customers will want to use it this way, so....." Just was a very frustrating process, and a frustrating product - I love what it does, but there are an unbelievable amount of footguns laden in the enterprise version, not to mention it has a way of worming itself irrevocably into your infrastructure, and due to extremely weird/obfuscated pricing models I'm fairly certain people are waking up to surprise bills nowadays. They also rug pulled some OSS features, particularly MFA login, which kind of pissed me off. The product (in my view) is pretty much worthless to a company without that.

neurostimulant 2y ago
They probably don't want their customers to use a competitor's product instead of Nomad.
JojoFatsani 2y ago
(I have no idea what your infra is so don’t take this as prescriptive) My feeling is that for the average company operating in a (single) cloud, there’s no reason to use vault when you can just used AWS Secret Manager or the equivalent in azure or GCE and not have to worry about fucking Etcd quorums and so forth. Just make simple api calls with the IAM creds you already have.
- JohnMakin 2y ago
  ime that’s a way better product to use for secrets management unless you’re trying to do very advanced CA stuff.
- elzbardico 2y ago
  This^ Unless you're a hybrid/multiple cloud environment, there's no much point in using Vault.
- leetrout 2y ago
  Caveat: the HCP hosted vault is reasonably priced and works well. However, strong agree on using your home cloud's service. We used Vault with Heroku and were happy.
  - candiddevmike 2y ago
    > Caveat: the HCP hosted vault is reasonably priced and works well. HCP hosted Vault starts at ~$1200/month, you'd have to use a metric shit ton of secrets in AWS or GCP to come close to that amount. Yes Vault does more than just secrets, but claiming anything HC sells as reasonably priced is a reach.
    - leetrout 2y ago

downrightmike 2y ago

We really need a 2.0 version that actually delivers the promise these tools never reached because legacy decisions

candiddevmike 2y ago

FWIW, "HashiStack" was a much discussed, much promised, but never delivered thing. I think the way HashiCorp siloed their products into mini-fiefdoms (see interactions between the Vault and Terraform teams over the Terraform Vault provider) prevented a lot of cross-product integration, which is ironic for how "anti-silo" their go to market is. There's probably an alternate reality where something like HashiStack became this generation's vSphere, and HashiCorp stayed independent and profitable.