#hashicorpvault — Public Fediverse posts

Just published: #Nvidia is now listed as an official adopter of #openbao an #openssf source fork of #IBM / #HashiCorpVault. It's among signs of growing interest in the project amid mounting global #digitalsovereignty concerns, OpenBao backers say. https://www.techtarget.com/searchitoperations/news/366644831/Nvidia-adopts-OpenBao-open-source-fork-of-HashiCorps-Vault

Short heads up: Vault's new 2.0.1 release doesn't work with their current Helm chart (as of v0.32.0) out of the box, due to the new CAP_IPC_LOCK required starting from that version.

Workaround is to add this to the values.yaml:

server.statefulSet:
securityContext:
container:
allowPrivilegeEscalation: false
capabilities:
add:
- IPC_LOCK

#HashiCorpVault #k8s #HomeLab

Envmap - Fini les fichiers .env qui traînent et finissent sur GitHub

https://fed.brid.gy/r/https://korben.info/envmap-secrets-sans-fichier-env-disque-github-leaks.html

Static Kubernetes ServiceAccount tokens are a long-standing security risk.
This post walks through authenticating workloads to HashiCorp Vault using JWT/OIDC, exchanging pod identity for short-lived, least-privilege Vault tokens via a Kubernetes-aware STS—without relying on static credentials.

#Kubernetes #HashiCorpVault #OIDC #WorkloadIdentity #ZeroTrust
https://www.tremolo.io/post/short-lived-tokens-with-vault-without-the-static-serviceaccount

New blog post: https://blog.mei-home.net/posts/k8s-migration-24-vault/

Migrating my baremetal Vault instance to k8s, including a general introduction to Vault itself and using Terraform to configure it.

Completely unrelated, is anyone interested in a couple of tons of Yak wool?

#HomeLab #Blog #HashiCorpVault

Did I miss a trend in JSON log formatting? HashiCorp's Vault seems to be of the opinion that all keys in their JSON logs should be prefixed by an "@"? As in:

{"@timestamp": "foobar", "@message": "baz"}

Very weird.

#HomeLab #HashiCorpVault

"It's hard to see a good way out right now for [#HashiCorp]." Users and analysts react to reports the #cloudnative vendor is seeking a sale #Terraform #HashiCorpVault #OpenTofu https://www.techtarget.com/searchitoperations/news/366574475/HashiCorp-stock-rises-users-hearts-fall-on-sale-report

Despite everything I #selfhost , I thought it was still a good idea to use #keybase to encrypt the unseal key for my #homelab #hashicorpvault instance.

Turns out their baked-in TLS cert expired on the 31st and rendered all installs defunct. Now I'm dependent on them to update and distribute a new client so that I can unlock my homelab #automation .

Lesson learned, #selfhosteverything

@mmeier I'm looking at this exact thing for my k3s cluster - was there a write up that you tried to follow/any hints to get Vault and Kubes to play nice?

#homelab #k8s #hashicorpvault

Well, there goes that idea... I had no idea that Kubes had so many certificates/CA roles. Let's Encrypt won't sign sub CA (which makes sense), so I'll have to rely on my CA stack in Vault.

Now I have a new problem... do I split my dns/certs into lab.fqdn.dev and fqdn.local (where the .dev DNS uses Lets Encrypt and the .local uses Vault?)

If so, I'll need to add a new layer to my DNS automation and create a new fqdn.local domain in PowerDNS...

What a fun way to spend Christmas Eve Eve.

#kubernetes #hashicorpvault #certificateauthority #letsencrypt #homelab

More #Homelab things to ponder.

I'm using LetsEncrypt wildcard for my internal network services (this works great by the way... Just don't use .dev as your TLD or you'll be sorry).

I'm on to the LDAP side of things now, and I'm debating if I should use the wild card cert for ldaps. My gut is telling me no, but I'm also kind of lazy and don't know if I want to set up another rig to handle left encrypt renewals.

I also have Hashicorp Vault going. So I suppose I could use that for my CA, but the whole point of using LE is to auto trust things.

#letsencrypt #Vault #hashicorpvault #ldaps

Vault has been forked!

https://github.com/openbao/openbao/tree/development

#Hashicorp #Vault #HashicorpVault #FOSS

For #HashiCorpNomad Enterprise customers, check out NUMA support. Should be a massive improvement for those trying to optimize CPU utilization and service performance across bare metal fleets:

https://developer.hashicorp.com/nomad/docs/concepts/cpu

Multi-cluster #HashiCorpVault is another new Enterprise feature that lots of customers have been eagerly awaiting. 🔐 🔐 🔐

HCP Vault Secrets is now generally available.
The general availability release of HCP #Vault Secrets builds on the beta release with production-ready secrets management capabilities, additional secrets sync destinations, and multiple consumption tiers.
To find out more visit https://hashi.co/3Qa57hk
#HashiConf #HashiCorp #HashiCorpVault

I've been thinking about Vault as my OIDC identity provider, and I won't do it. Better to separate the Homelab secrets store and service's user accounts.

So staying with Keycloak for now.

#HomeLab #KeyCloak #HashiCorpVault

This medium article Nik Long is the start of a series on getting the HashiStack working together.

Finding a comprehensive example of the Hashicorp Stack working together is not so easy to find. This the first of a series of articles called Getting Started with Hashicorp Stack on AWS. link.medium.com/twZgZYwj6wb

#Hashicorp #HashicorpVault #HashiCorpConsul #HashiCorpNomad #howto #guide

I'll put this out here in case someone wants to beat me to it:

Create a #HashicorpVault auth plugin that uses #Tailscale to authenticate. Possibly authz based on tags.

I've been meaning to get around to this so I can properly handle secret management on all my #NixOS systems. But I've got other projects that I keep needing to get done first 😅