Keywhiz
A deprecated tool for managing and distributing secrets within infrastructure environments.
| Category | Secrets Management |
|---|---|
| Last Commit | 5 years ago |
| This page updated | a month ago |
| Pricing Details | Free and open source, but deprecated. |
| Target Audience | Developers and DevOps teams managing secrets in infrastructure. |
Keywhiz, although now deprecated and no longer maintained, was designed to address the critical challenge of managing and distributing secrets within infrastructure environments. The system relied on a Java-based architecture, requiring Java 11 and MySQL 5.7 or higher to operate. It utilized the Dropwizard framework for building the server, and jOOQ for database interactions, which allowed for robust and flexible database management.
From an operational standpoint, Keywhiz was configured to run via a shaded JAR file, with commands such as migrate, add-user, and server facilitating setup and administration. The system supported SSL/TLS encryption, with options to specify custom trust stores, which was crucial for secure communication. However, it had limitations, such as the need for manual configuration of the database and the potential for performance issues, particularly with the automation API and database interactions.
Keywhiz also included features like HMAC on database rows to detect tampering and database-enforced uniqueness constraints on secret names. Despite these functionalities, the project's deprecation and lack of ongoing maintenance mean that users should consider alternative solutions like HashiCorp Vault for more robust and actively supported secret management.