Secrets at Shopify - Introducing EJSON - Shopify

This post introduces EJSON, a library for encrypting secrets within JSON files using asymmetric encryption. It details the motivation for moving away from Chef's symmetric encryption, including issues with key management, synchronous deployment, auditing, and containerization. The post explains how EJSON works, including the use of public/private keys and the `ejson` command-line utility. It also describes the key management process, where secrets are re-encrypted with a single 'infrastructure' key for runtime decryption within containers, and the challenges and solutions for securely inserting and revoking decryption keys during container startup.