Support for Vault as Storage backend?

[InAnimaTe]

Wondering this is something anyone cares about or a future roadmap item already semi-planned?

[simonswine]

What exactly are you talking about?

I can see many ways of integration with vault. Primary kube-lego use case is requesting certificates from a CA. As long as Vault is not implementing a ACME protocol, we can't support it.

[InAnimaTe]

Sorry should have been clearer. I meant utilizing vault as a storage backend for obtained certificates (and keys) and ACME user keys etc.. Basically, instead of utilizing k8s secrets, it'd be nice to utilize Vault instead (and even others down the road)

[llpaul]

+1. Kubernetes secrets are misnamed. They are not secret; they are available to anything in the cluster and they are stored in Base64. Support for HashiCorp Vault would be much better, especially for private key storage.

[dodizzle]

+1

[madmod]

+1 Kubernetes secrets are not secure enough for some production workloads.

[masteinhauser]

Looks like the request behavior works as requested using a bash shell script to wrap, someone likely could add similar support into this agent. https://github.com/ketchoop/letsencrypt-to-vault

Following up as I came across for an unrelated Vault + ACME protocol search.