Running Vault on Kubernetes is generally the same as running it anywhere else. Kubernetes, as a container orchestration engine, eases some of the operational burdens and Helm charts provide the benefit of a refined interface when it comes to deploying Vault in a variety of different modes.
In this tutorial, you will set up Vault and its dependencies with a Helm chart. You will then integrate a web application that uses the Kubernetes service account token to authenticate with Vault and retrieve a secret.
Tested against the latest release, HEAD ref, and 3 previous minor versions (counting back from the latest release) of Vault. Current official support covers Vault v1.4.7 or later.
As enterprises accelerate their digital strategies, adoption of hybrid or multi-cloud architectures are becoming the new norm, requiring a fundamental shift in how infrastructure is provisioned and managed. When managing secure administration access to Unix-like servers, SSH is still the standard connectivity method. However, it does come with challenges and risks, especially in relation to key management.
Fabio is an HTTP and TCP reverse proxy that configures itself with data from Consul.
Traditional load balancers and reverse proxies need to be configured with a config file. The configuration contains the hostnames and paths the proxy is forwarding to upstream services. This process can be automated with tools like consul-template that generate config files and trigger a reload.
Fabio works differently since it updates its routing table directly from the data stored in Consul as soon as there is a change and without restart or reloading.
When you register a service in Consul all you need to add is a tag that announces the paths the upstream service accepts, e.g. urlprefix-/user or urlprefix-/order and fabio will do the rest.
Providers are a logical abstraction of an upstream API. They are responsible for understanding API interactions and exposing resources.
The VMware Cloud Director provider is used to interact with the resources supported by VMware Cloud Director. The provider needs to be configured with the proper credentials before it can be used.
Use the navigation to the left to read about the available resources. Please refer to CHANGELOG.md to track feature additions.
The OpenTelekomCloud provider is used to interact with the many resources supported by OpenTelekomCloud. The provider needs to be configured with the proper credentials before it can be used.
OpenNebula provider for Terraform.
- Leverages OpenNebula's XML/RPC API
- Tested for versions 5.X
This is based on a project started by Runtastic, and has been enhanced by BlackBerry to allow for definition of these resource types:
- Virtual Machines
- Images
- VNET Reservations
- Security Groups
As well as data sources for:
- Images
- VNETs
- Security Groups
An Ansible dynamic inventory script to process Terraform state and return Ansible host data from Terraform Provider for Ansible host resources. See the Terraform Provider for it's own installation and use.
Infrastructure as Code (IaC) is changing the way that we’re doing things. Some people think that it’s the motorway that we have to follow and be aligned with business, as a resume they want us to be agile.
The arrival of tools such as Ansible, Puppet, SaltStack, and Chef, have enabled sysadmins to maintain modular, automatable infrastructure. This time I would like to introduce the Terraform tool.
Terraform is a provisioning declarative tool that is based on the Infrastructure as Code paradigm. Terraform is a multipurpose composition tool: it composes multiple tiers (SaaS/PaaS/IaaS).
Terraform is not a cloud agnostic tool, but in combination with OpenNebula, it can be amazing. By taking advantage of the template concept it will allow us to deploy vm’s agnostically in different cloud providers, such as AWS, Azure or on premise cloud infrastructure.
When working with Ansible and Terraform, I felt there was a gap in the workflow, so I built a Terraform Provider for Ansible. It integrates with a Terraform Inventory script to connect machines in your Terraform state to Ansible. This article explains my thought process in designing this integration.
Fast jede Webanwendung sorgt selbst für das sichere Speichern von Zugangsdaten. Vault ist eine Alternative, die in Entwicklungsumgebungen ohne großen Administrationsaufwand funktioniert.
Nahezu jede Webanwendung enthält Geheimnisse, etwa in Form von Zugangsdaten zu Drittsystemen wie Datenbanken oder Fileshares. Jede Anwendung steht damit vor der Herausforderung, sie sicher zu speichern. Mit dem Projekt Vault von Hashicorp steht hierfür [1] ein umfangreiches und erweiterbares Open-Source-Tool zur Verwaltung von eben jenen Geheimnissen und zum Schutz der darin gespeicherten Daten zur Verfügung ("Manage Secrets and Protect Sensitive Data"). Im Dezember 2018 hat das Projekt Version 1.0 erreicht und liegt damit erstmals in einer stabilen Edition vor. Höchste Zeit für die ersten Schritte mit Vault in einer Entwicklungsumgebung.
HashiCorp Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Vault handles leasing, key revocation, key rolling, and auditing. Through a unified API, users can access an encrypted Key/Value store and network encryption-as-a-service, or generate AWS IAM/STS credentials, SQL/NoSQL databases, X.509 certificates, SSH credentials, and more.