6 votes
Accepted

How does Hashicorp's Vault compare to Lastpass?

I don't have enough rep to comment but I'm going to expand on what RuBiCK said. In the first case, if you have a password for JIRA that I'm going to use to log in to the website with and fiddle with ...
user avatar
  • 1,082
5 votes
Accepted

Is Hashicorp's Vault suitable for personal projects as well?

Vault will distribute multiple unseal keys but there's nothing to stop you from keeping all of the keys in one place for a personal project. The one time I did it I set the keys to 3 and kept them in ...
user avatar
  • 1,082
4 votes
Accepted

How to unseal a Vault in practice?

I assume your vault would be being accessed over a network, so you would ask a colleague to use their own command line on their own workstation to enter their key. Mine requires 3 keys to unseal so I ...
user avatar
  • 211
3 votes

Access vault secret from bash script

The vault docs mention a -field parameter for the read subcommand. So you should be able to put this into a shell script: SECRET=$(vault read -field foo secret/mysecret) Other vault docs use the ...
user avatar
  • 1,728
3 votes
Accepted

Is it possible to recover accidentally deleted HashiCorp's Vault secrets?

If your secret backend is a separate service, which it should be, then with regular backups you should be able to stop vault, replace the backend with a backup and be good to go. I've done this for a ...
user avatar
  • 1,082
3 votes
Accepted

Vault `SSH-CA` Elliptic Curve rather than `RSA`

I think the answer should be yes to ecdsa but no to ed25519, but that it is currently no to both. You can externally generate an ecdsa keypair and load it into ssh/config/ca but vault-1.4.3 cannot ...
user avatar
3 votes
Accepted

Is there an organization that offers a Hashicorp Vault SaaS solution?

It seems that Hashicorp itself offers an enterprise solution including 24x7 gold support called Hashicorp Vault premium enterprise.
user avatar
  • 12.6k
3 votes
Accepted

What are best practices for sharing and accessing Vault secrets?

Assuming person B has a role which also allows them access to the path secret/hello, then they would simply run vault read secret/hello from their own machine. If you're following the demo, I think ...
user avatar
  • 211
2 votes

How does Hashicorp's Vault compare to Lastpass?

Lastpass is for your personal (or team) passwords. I would not use Lastpass for storing credentials of service accounts. Use HashiCorp's Vault or any other solution like Amazon KMS for ...
user avatar
  • 305
1 vote

How to use Hashicorp Vault with NodeJS application?

As the Linux philosophy says: Make each program do one thing well So it's worth it to use the vault agent, cause it's doing well what it would be done. You can find an awesome example here
user avatar
  • 349
1 vote
Accepted

How to protect secrets whilst enabling the ability to amend a pipeline

Developers or even admins of your GitHub repository wouldn't be able to see secrets configured there by default. Even if you debug GitHub Actions workflows and accidentally log secrets, GitHub would ...
user avatar
  • 767
1 vote

Hashicorp vault not writing out KV

You have your VAULT_ADDR set to HTTP, but vault is listening on TLS - the error you are receiving is the HTTP request receiving a TLS handshake. Try changing VAULT_ADDR to https://mydomain.com.
user avatar
1 vote

Planning a backup system using postgress, chef and vault

First chef runs as often as you configure it to do. Second Chef is a configuration management system and not a crontab or an orchestration system. Use chef to configure cron (that can not be not an ...
user avatar
  • 11.1k
1 vote

Is there an organization that offers a Hashicorp Vault SaaS solution?

To my knowledge there are no services today that offer Vault SaaS. However, if you're looking for a better UI/UX, there are great options out there for a Vault UI (A full Hashicorp supported list can ...
user avatar
1 vote
Accepted

Why not run a stateless Hashicorp Vault in production?

I think you're misunderstanding what is considered bad practice. Running vault with an in memory backend and being able to spin it up and provision it is fine. What is Not Fine is seeding the secrets ...
user avatar
  • 1,644
1 vote
Accepted

Recommended Design - Communication among Jenkins + Vault + App

My choice would be design B. It's true that the availability of the Vault would be crucial, but Jenkins' availability would similarly be crucial in design A. So from this perspective the decision ...
user avatar
1 vote
Accepted

When setting up HashiCorp Vault in HA mode, is it normal that you have to unseal each Vault node?

According to this documentation, each vault has to be unsealed in a HA setup. Now you need to initializing and unsealing each Vault instance. # Initialize vault_s1 $ vault operator init # Unseal ...
user avatar
  • 12.6k
1 vote

How to pass HashiCorp Vault secrets(k/v passwords) to Terraform EC2 instance

The simplest case is to use the Terraform Vault Provider (https://www.terraform.io/docs/providers/vault/index.html) - which, caveat, I've not used myself. Example from the Terraform site: provider "...
user avatar
  • 131
1 vote
Accepted

What does implementing Hashicorp Vault mean in practice?

In the hope of resurrecting this question, I will give my opinionated answer. As I understand it, the use of Vault is part of the drive to give more autonomy to teams, by removing fear of leaking or ...
user avatar
  • 3,098
1 vote

Why HashiCorp vault returning null?

If you are unsure what happened, try deploying it in AWS via AWS vault quickstarts. They deploy vault end-to-end, so now you can compare it to yours and find out what was the problem.
user avatar
1 vote

Access vault secret from bash script

I've ended up at exactly the same spot. We have a Vault server holding a good deal of secrets for different environments and various endpoints for each environment, so we set up kv engines for every ...
user avatar
  • 11
1 vote

Access vault secret from bash script

This mighty be a lengthy procedure but worth implementing, creating child tokens to fetch information from Vault Server. Execute following procedure at Vault Server. Create policy to restrict the ...
user avatar
1 vote

Is Hashicorp's Vault suitable for personal projects as well?

One thing you should know is, even though you can backup vault(consul, if you are using one as backend), you cannot restore to a new vault installation (if you loose the existing one). You can just ...
user avatar
1 vote

What are best practices for running Hashicorp's Vault in terms of high availability?

Well, the first step is to use a backend which supports HA. Consul, for example, supports HA. If you are not an enterprise customer, you may have to run a shell script via cron to upload consul ...
user avatar
1 vote
Accepted

What are best practices for running Hashicorp's Vault in terms of high availability?

According to this documentation two vault servers have to be run. One of them has to be active and the other passive. In order to run such a setup both vault servers need to be unsealed.
user avatar
  • 12.6k
1 vote

Use Vault SSH OTP backend with Jenkins

I looked at Jenkins plugins for vault, but they only work for fetching secrets from Vault. It depends how the current configuration looks like that is used to deploy apps. https://github.com/...
user avatar
  • 12.6k

Only top scored, non community-wiki answers of a minimum length are eligible