Questions tagged [vault]

Questions about Hashicorp's Vault tool for managing secrets

Filter by
Sorted by
Tagged with
0
votes
0answers
10 views

OCSP setup for Vault

I have vault setup running in container for PKI Secrets Engine and would like to add OCSP support for application to check if certificate is not revoked. I didn’t find any explanation on how to setup ...
0
votes
0answers
22 views

Vault invalid certificate or no client certificate supplied - cert auth method

I have created a CA in Vault to handle my certificate creation. I've followed this guide here: https://learn.hashicorp.com/vault/secrets-management/sm-pki-engine I am trying to generate a client ...
2
votes
3answers
178 views

Securing SSL certificate private key with nginx

I've been researching how to secure privaye keys for SSL certificats using nginx as a webserver, but have not been able to find many satisfactory answers. Specifically, for a client who wants to me ...
0
votes
0answers
50 views

How to store Vault audit logs when running vault in a Docker container

I'm researching the various audit devices for Hashicorp Vault. My goal is to run Vault in a Docker environment (currently Docker Swarm). The File method is fairly straightforward, but I'm also ...
0
votes
1answer
61 views

Vault pod going to crashLoopBackOff state on restarting

We have configured vault to run as a pod in the cluster. In the below deployment YAML file, we have included the vault initialisation and unsealing to happen when the pod comes up initially. But when ...
0
votes
1answer
76 views

Trying to deploy vault:1.2.4 in kubernetes

I have been trying to bring up a Vault pod in K8!, I am using vault:1.2.4 and I have added the capability and config in the yaml as mentioned in the official docker page of vault But still, I always ...
0
votes
0answers
53 views

Accessing instances of applications with public DNS records that resolve to private IPs

I have an instance of Hashicorp Vault running on a DigitalOcean droplet. I have set up Certbot to obtain a Let's Encrypt certificate for use with TLS. The certificate is valid for use on the domain ...
0
votes
0answers
17 views

Oracle Cloud Infrastructure Key Vault and KMIP protocol

I was checking OCI documentation around Key Management System (KSM) which I can create from OCI console. The documentation does not mention if KSM Vault implements KMIP protocol. I also verified ...
0
votes
2answers
77 views

vault init hangs on kubernetes

I'm trying to set up an autosealing vault cluster in kubernetes but I'm seeing some strange behaviour. I have one vault providing the transit secret to autounseal the second vault . They are running ...
2
votes
1answer
1k views

Hashicorp Vault - Policy restricting one specific sub node in a path

I have a Hashicorp Vault server configured and everything is running great, except for my "deny" policies. I have a 2 level grouping for the majority of secrets, so they follow the structure of: ...
1
vote
0answers
55 views

Use Vault to manage Kubernetes secrets

We are using Kubernetes on Google Kubernetes Engine - we currently have secrets added manually with the kubectl secret CLI. To make the secrets management more secure and easier across the team, we ...
0
votes
1answer
1k views

How to Use Azure Key Vault w/ Web App

I have an Azure Web App for a client project. The project also requires Azure SQL Databases and Blob Storage. All pieces mentioned are up and running but we've been told we can't have any password ...
0
votes
1answer
396 views

Consul, vault and postgres containers don't communicate

I'm trying to set up Consul with Vault for secrets management for Postgres with Docker. Here is my configuration Dokcerfile: FROM python:3.6-slim ENV VAULT_VERSION 0.11.1 ENV CONSUL_VERSION 1.2.3 ...
1
vote
1answer
393 views

Vault - generate secret without revealing it?

With Hashicorp's Vault, is it possbile to generate a secret without revealing that secret to the user who generated it? Along the lines of: vault generate secret/my/awesome/secret 32 Where it would ...
7
votes
2answers
17k views

HAproxy health check for https backend

I have haproxy configuration that works perfect for vault server in the backend with http configuration and it load balance based on unsealed and active vault server using 200 OK code. This works for ...
2
votes
2answers
5k views

Net bind capability with systemd

I am deploying Goldfish, an interface for Vault, in production on a server dedicated to secrets management. So security is of prime concern here. I am trying to deploy the service with systemd on an ...
2
votes
0answers
139 views

Can consul-template fetch Vault servers from consul?

I would like to integrate HashiCorp vault into our current setup of consul + consul-template and was a bit surprised to find no option for consul-template to fetch the vault servers from consul's ...