Hi everyone, I'd like to explore mechanisms to provide secrets to applications deployed on Mesos (e.g. via Marathon or Apache Aurora).
The classical workflow of having the passwords encrypted in the local git repository and only decrypted during deployment (for example via ansible vault) tends to fall too short. From the user perspective the deployment is done once its job has been submitted to the service scheduler. Then however, the passwords would be unsecured when traveling through the various Mesos and scheduler layers. It might potentially been visible to anyone having access to either the scheduler or the Mesos UI. One possible solution is to provide an out-of-band mechanism to distribute passwords to all slaves and to protect those passwords using the regular Linux permissions, making them only accessible to authorized tasks. Other solutions might involve the integration of tools like HashiCorp Vault or Square Keywhiz. Is anyone willing to share his/her experience with handling such secrets? Thanks and Best Regards, Stephan
