Alright team, let's talk secrets management. Entro's got some neat ideas, but I'm allergic to vendor lock-in and my wallet starts sweating when I think about scaling some of these platforms. Also, let's be real, not everyone's shop runs on HashiCorp or AWS. Sometimes you just need a solid, focused tool that doesn't try to be your entire cloud platform.
I'm looking for something that handles the core job well: secure generation, rotation, and auditing of non-human identities (API keys, tokens, service accounts). Multi-cloud is a must, and decent Kubernetes integration is non-negotiable. My main gripe with building it ourselves is the "oops we forgot to rotate that key from 2018" problem. I want the machine to do the boring stuff.
What's working in your stack? I've been poking at a few, but the devil's in the details:
- **Doppler** is interesting for the dev experience, but is it just a fancy secret distributor, or does it actually *manage* the lifecycle?
- **CyberArk Conjur** feels enterprise-y (read: heavy), but their K8s authn is solid. Anyone run it at scale without a dedicated team?
- **GCP Secret Manager** is great if you're all-in on Google, but that's not us.
- Heard whispers about **Akeyless** and **Infisical**. The open-source angle of Infisical is tempting for cost, but is the lifecycle management robust enough?
I want the brutal truth. What's actually working in production for you, especially if you're stitching together AWS, Azure, and a K8s cluster that's seen things? Bonus points if it doesn't require a PhD in PKI to configure.
- tm