Some quick points as a very early adopter of Vault:
- Absolutely take an incremental approach, there is a learning curve
- Use a high availability backend. I started out with just consul, but have since went with consul for HA, and cockroachdb as the data store.
- Practice your disaster recovery a many times before you go all in
- use a combo of paper plus offline digital storage for the unseal keys and root tokens
- be diligent about roles/policies
- rely on tokens more than any other auth method(username/pass, certs)
- don’t be afraid to use many vault instances that can talk to a core instance for things like transit auto unseal
All that said, I absolutely think it’s worth the investment if you have the infrastructure to back it(aka a cluster without a SPOF)
The PKI backend is phenomenal, and it makes a great sidecar for any app that needs auth, secrets, or general crypto stuff using the transit backend.
I really want to create a user friendly Password Manager/TOTP front end backed by vault. Someday…
- Absolutely take an incremental approach, there is a learning curve
- Use a high availability backend. I started out with just consul, but have since went with consul for HA, and cockroachdb as the data store.
- Practice your disaster recovery a many times before you go all in
- use a combo of paper plus offline digital storage for the unseal keys and root tokens
- be diligent about roles/policies
- rely on tokens more than any other auth method(username/pass, certs)
- don’t be afraid to use many vault instances that can talk to a core instance for things like transit auto unseal
All that said, I absolutely think it’s worth the investment if you have the infrastructure to back it(aka a cluster without a SPOF)
The PKI backend is phenomenal, and it makes a great sidecar for any app that needs auth, secrets, or general crypto stuff using the transit backend.
I really want to create a user friendly Password Manager/TOTP front end backed by vault. Someday…