hashicorp/envconsul — pull request #15 by ryanbreen (2014-09-19 15:50:43+00:00)
Title: Add support for encrypted values.

gocrypt is a library I wrote to wrap values in AES 256-bit GCM encryption. The user encrypts the value using a key known only to them and a subset of systems on which envconsul runs. The value is decrypted after it is pulled from Consul and before it is exported into the environment.

This end-to-end encryption of values is useful for secure environments, such as cardholder environments, where there are fairly stringent restrictions on who should be able to read critical data such as passwords and DB connection strings. With this support in place, we can safely check our configuration data into Git, place it in Consul KVs, and trust that only the correct machines can see the plaintext values.