HashiCorp Consul vs. HashiCorp Vault

Consul looks to me like an amazing solution to store configuration data. In huge cloud environments like what we are using nowadays, it is quite important to have a reliable source of parameters to our distributed applications, easily scalable and also, easy to change parameters spreading them efficiently over our entire environment.

Incentivized

Vault is a reliable and resilient as the Key Management System. It is not for the novice user that does not have a background in information security. It requires a significant time investment into the different key engines that the solution offers to get started. It works very well once implemented and is very flexible in general.

Incentivized

• Service Health: Using Consul for service health/discovery has been critical to our success in a hybrid environment
• K/V Store: The Consul K/V store is the best solution out there for our particular use case, which is as a locking mechanism to coordinate otherwise random runs of our configuration management system. This has allowed us to have peace of mind of system availability in our on-prem infrastructure.
• API: The Consul API as a whole is excellent and extremely easy to work with
• Documentation: Hashicorp really does documentation well. Their examples are easy to follow and everything is written in a manner that is easy to understand for beginners with the tool.

Incentivized

• The HTTP API you use to write and read secrets is open and can be used by any application.
• It keeps our sensitive data/credentials out of our GitLab repositories.
• Sealing and unsealing the Vault on demand adds an additional layer of security.

Incentivized

• Error logs - some of the errors require Googling as you have no idea what they mean
• Misconfiguration is painful - strange errors can occur if you make even a tiny mistake

Incentivized

• Documentation for the API moves slower than changes in the API itself
• The database secret engine's API design isn't as elegant as it could be
• No support for revocation of all secrets under one path

Incentivized

HashiCorp Vault is the best there is out there, and it has become critical to our secret management use cases. It would be difficult to find anything that would suit our needs better and that would be beneficial for us to switch over to.

Incentivized

Consul's API is extremely user friendly. While their web interface isn't quite as "mature", it's still pretty easily navigated for the average person. Together they make a pretty easy to pick up and use tool.

Incentivized

We spent a little more time than we imagined to conceptually understand how HashiCorp Vault operates, as well as how it is configured. This is not trivial, and keep in mind that you will need to take some time to get a thorough understanding of the tool. The documentation could be more helpful in this regard.

Incentivized

I've never used paid support from HashiCorp, but I consider its support a good one, since they provide a lot of free resources for the community and there are good user groups supporting you on several sorts of issues. Also, HashiCorp is known as a company with a strong relationship with the community, that is easily noticed by the events HashiCorp promotes over the world.

Incentivized

Hashicorp has been very responsive to our questions and inquiries up to this point. We are currently working on them to develop a more granular permissions model within Vault. We are very close to achieving our objectives with the help of their support team. We do not seem to be in the same time zone which makes it hard for escalated issues.

Incentivized

We used to use Microsoft SQL Server for configuration management of our services. Unfortunately that was a pain because of:

• Developers did not know how to persist objects effectively in MS SQL Server
• SQL queries or a custom web UI were the ways of keeping the data up to date, but both options were hard to use
• Each service would have its own slightly different configuration in a file and in MS SQL Server so that caused a lot of confusion and configuration management overhead

Consul brought the following benefits:

• Its own modern web UI
• Streamlined use of objects and multiple different configuration (JSON-based)
• Service DNS vs IP addresses is a God-send for the dev and operations teams.

Incentivized

HashiCorp Vault integrates with a lot of tools and systems, and the documentation was pretty robust with a lot of community help. Because HashiCorp Vault is also older than other solutions, it is already well developed with a lot of features you need for storing secrets and configuration. HashiCorp Vault is also friendlier towards application build and is focused in providing security and a lot of customization for almost any use case scenario. Bitwarden is more limited to password management of enterprise accounts, but for application usage is not that great or easy to integrate. It does not scale well also. AWS Secrets Manager on the other hand is really good but more limited to AWS applications and vendor lock is problematic as well for such a critical piece of infrastructure.

• It contains a native web UI, which in contrast to its counterparts, is handy, very intuitive and - most importantly - very informative. It leaves no room for doubt about your services "forest" health. So, for that purpose, the learning curve was almost down to non-existent. Our team managed to work seamlessly with Consul being our services API
• Our management staff had a difficult time understanding what Consul was really all about. For technical staff it is pretty simple to understand the huge value such a tool can pose to our suite of solutions, but once our management staff took the grasp of its valuable handy set of tools, we didn't take long to start using it and keeping track of our Swarm overall health, with was a constant concern for the entire company before.
• For load balancing purposes, we were relying pretty much on guesses before we decided to use Consul. One would check a certain node overall health and decide if we would need to spring a new instance at AWS or Digital Ocean.

Incentivized

• Allowed better access control for credentials, passwords, and important keys.
• After we started using HashiCorp Vault, we were able to base our environment 100% as code.
• SSH access control that is possible using HashiCorp Vault adds an extra level of security in environments where external remote access is required.

Incentivized