Questions tagged [hashicorp-vault]

For questions about HashiCorp's Vault product - a tool for managing tokens, passwords, certificates, API keys, and other secrets.

Filter by
Sorted by
Tagged with
0 votes
0 answers
1k views

fetch all secrets from vault using external secrets operator

I've deployed the external secrets operator https://github.com/external-secrets/external-secrets and Hashicorp vault in the same cluster via helm. I've authenticated externalsecrets to vault using the ...
Axel's user avatar
  • 101
1 vote
0 answers
247 views

Only allow listing of specific mount points in Hashicorp Vault

I have a Vault instance with MySQL Database engines created under specific paths, like so: mysql/dev/my-instance-1 mysql/staging/my-instance-2 mysql/prod/my-instance-3 now I allow users to list ...
0xE02B7's user avatar
  • 31
-1 votes
1 answer
1k views

HashiCorp Vault roles

It's quite easy to create roles for policies and also list them in HashiCorp Vault: vault write auth/jwt/role/myrolename ... ... list auth/jwt/role However, I can't find anything regarding how to ...
Ta Mu's user avatar
  • 6,802
2 votes
1 answer
1k views

How to use Hashicorp Vault with NodeJS application?

I have Node JS app inside pods, which needs to read vault secrets. So far I found 2 methods for doing that Using init container to mount secrets as .txt files and read/parse them in my app Using node-...
Pablo's user avatar
  • 131
1 vote
0 answers
109 views

How to use Vault generated certificates for Internal Domains in AWS

I have generated certificates for an internal domain using Hashicorp Vault. I have exported the private key, certificate body and certificate chain. I have uploaded the certificate onto AWS ...
YYashwanth's user avatar
2 votes
1 answer
75 views

How to protect secrets whilst enabling the ability to amend a pipeline

I'm writing a CI pipeline using GitHub Actions. The pipeline will build a Docker image, which it will then push to our Docker repository (AWS ECR). In order to talk to ECR, we'll need to provide a ...
JohnLBevan's user avatar
2 votes
1 answer
348 views

Vault `SSH-CA` Elliptic Curve rather than `RSA`

Is it possible to use ECDSA(Elliptic Curve Digital Signature Algorithm) or EdDSA( Edwards-curve Digital Signature Algorithm) instead of RSA when configuring SSH-CA on HashiCorp Vault?
Woodstock's user avatar
  • 123
1 vote
1 answer
210 views

Why not run a stateless Hashicorp Vault in production?

I'm contemplating whether to provision Hashicorp Vault from code, from scratch, and seed it with keys to be shared between a few, predefined consumers (some humans, some services). The provisioning ...
David's user avatar
  • 13
2 votes
1 answer
136 views

Recommended Design - Communication among Jenkins + Vault + App

Design A: CD tool communicate with Vault to fetch App secrets on its behalf Jenkins ( CD tool ) computes the Vault path according to the app/project & according to which environment the app will ...
Abdennour TOUMI's user avatar
1 vote
1 answer
78 views

How to manage Hashicorp Vault patching in AWS?

I'm setting up a Hashicorp Vault open source deployment in AWS, but I'm trying to figure out the best approach for keeping the underlying EC2 instances patched. I'm using AWS Systems Manager for ...
Prime's user avatar
  • 111
1 vote
1 answer
632 views

When setting up HashiCorp Vault in HA mode, is it normal that you have to unseal each Vault node?

My goal has been to setup Vault in HA mode. Based on the docs, I was under the assumption that if you had a node that is in 'standby' it would forward to the active node, thus not having to unseal (...
xil3's user avatar
  • 113
1 vote
1 answer
873 views

How to pass HashiCorp Vault secrets(k/v passwords) to Terraform EC2 instance

How can we pass HashiCorp Vault secrets, k/v username/password and feed Terraform while its creating Ec2 instance. For example, i don't want to use in plain text variable "myvariable" { default = "...
Dejan Bodiroga's user avatar
0 votes
1 answer
114 views

What does implementing Hashicorp Vault mean in practice?

I have read several Hashicorp Vault tutorials and one of the features that could be used is generating ssh keys for git clone repositories, but that implies that everybody in the company that clones ...
030's user avatar
  • 13.1k
3 votes
1 answer
387 views

Why HashiCorp vault returning null?

I have a HashiCorp vault setup and it seems to return null all the time except when I ssh into the VM and then I set the values again followed by checking the values directly on the vault server. Any ...
user avatar
4 votes
5 answers
26k views

Access vault secret from bash script

I am looking for help on a direction on where to go from here. I have a Hasicorp Vault server running and accessible over DNS (local). I need to have a script get a secret from it then use that secret....
user avatar
1 vote
2 answers
490 views

Hashicorp vault not writing out KV

I am trying to set up a Hashicorp Vault server and have ran into some more road blocks. I can not get it so that I can write/read data either locally or through a domain name (I know the risks of have ...
user avatar
0 votes
1 answer
63 views

Planning a backup system using postgress, chef and vault

As the title says I am working on planning a way to backup postgres using chef and vault. Idea is that we already encrypt the backups from postgres using a key (random binary string) and we would like ...
user avatar
2 votes
2 answers
1k views

How to unseal a Vault in practice?

It is possible to force that multiple keys have to be entered in order to unseal the vault. How does this work in practice? If someone has entered a key and there is another key required to unseal the ...
030's user avatar
  • 13.1k
6 votes
3 answers
2k views

Is there an organization that offers a Hashicorp Vault SaaS solution?

There is a number of recommendations to harden a Hashicorp Vault deployment, but is there a SaaS solution, like CloudBees offers Jenkins to prevent that the hardening should be done manually?
030's user avatar
  • 13.1k
1 vote
2 answers
500 views

Is Hashicorp's Vault suitable for personal projects as well?

The Vault documentation indicates that there is a master key and that multiple keys are required to access the secrets, but does this mean that Vault is not suitable for personal projects if there is ...
030's user avatar
  • 13.1k
2 votes
2 answers
1k views

What are best practices for running Hashicorp's Vault in terms of high availability?

The Production Hardening document indicates how to harden Vault for production purposes, but what if Vault is run on for example Digital Ocean and the platform is unavailable or the disk gets ...
030's user avatar
  • 13.1k
1 vote
1 answer
909 views

Is it possible to recover accidentally deleted HashiCorp's Vault secrets?

According to this tutorial, it is possible to delete a secret, by running: vault delete secret/hello What will if someone in the organization accidentally removed a secret. Is it still possible to ...
030's user avatar
  • 13.1k
7 votes
3 answers
6k views

How does Hashicorp's Vault compare to Lastpass?

In this section Hashicorp compares Vault with other solutions. How does Hashicorp's Vault compare to Lastpass? Attempt to answer the question It is possible to login to LastPass from a web browser, ...
030's user avatar
  • 13.1k
0 votes
1 answer
196 views

What are best practices for sharing and accessing Vault secrets?

When one follows a Hashicorp's Vault demo, one has to issue vault init -key-shares=1 -key-threshold=1 at a certain moment that generates a key 1 and root token: Key 1: ABC Root Token: XYZ If person ...
030's user avatar
  • 13.1k
8 votes
1 answer
1k views

Use Vault SSH OTP backend with Jenkins

I'm setting up Vault to store secrets. SSH backend with OTP auth looks like a good way to stop managing SSH keys for access. I have SSH backend working, and am looking at hooking up Jenkins with the ...
grumpyops's user avatar
  • 334