5 ms·

A simple example that we use them for is for dynamic database credentials. So you no longer define a static username/password. You request the access/credential

A simple example that we use them for is for dynamic database credentials. So you no longer define a static username/password. You request the access/credentials from vault as you need them.

shay_ker 6y ago
how does that actually work? Vault has the user/password, and then acts as a gateway to the db?
- tecleandor 6y ago
  IIRC, Vault has plugins with GRANT access to your database, and rotates your passwords automatically. So it is able to create new users when access is requested, and to rotate passwords if needed. https://www.vaultproject.io/docs/secrets/databases/mysql-maria https://www.vaultproject.io/docs/secrets/databases/mysql-mar...
- quinndiggity 6y ago
  It looks like this https://www.nomadproject.io/docs/integrations/vault-integration#submitting-a-job-with-a-vault-namespace https://www.nomadproject.io/docs/integrations/vault-integrat... It's incredibly simple, and a breeze to use. ``` job "vault" { group "demo" { task "task" { vault { policies = ["database"] } template { env = true data = <<EOF {{ with secret "database/creds/production" }} DB_USERNAME={{.Data.username}} DB_PASSWORD={{.Data.password}} {{ end }} EOF } } } } ``` edit: thanks HN formatting
  - quinndiggity 6y ago
    with this setup, Vault will create a new database user based on the configuration you set (read-only for some services, for example), and will attach a time-to-live to those credentials; as long as the application is using them, it will renew the TTL. When an application is killed, or scaling happens, etc, and the application instance isn't using those specific credentials, Vault will clean up and remove the unused account cleanly Can do all sorts of great things with this; for example TLS (ssl) certificate renewals, etc, as the certificate expiry IS the TTL; when a certificate needs to be renewed it can happen automatically and your application can receive any signal you choose (SIGHUP, for example)
    - shay_ker 6y ago
      Fascinating! Thanks for sharing, I had no idea this was possible.

A simple example that we use them for is for dynamic database credentials. So you no longer define a static username/password. You request the access/credentials from vault as you need them.

shay_ker 6y ago

how does that actually work? Vault has the user/password, and then acts as a gateway to the db?

tecleandor 6y ago
IIRC, Vault has plugins with GRANT access to your database, and rotates your passwords automatically. So it is able to create new users when access is requested, and to rotate passwords if needed. https://www.vaultproject.io/docs/secrets/databases/mysql-maria https://www.vaultproject.io/docs/secrets/databases/mysql-mar...
quinndiggity 6y ago
It looks like this https://www.nomadproject.io/docs/integrations/vault-integration#submitting-a-job-with-a-vault-namespace https://www.nomadproject.io/docs/integrations/vault-integrat... It's incredibly simple, and a breeze to use. ``` job "vault" { group "demo" { task "task" { vault { policies = ["database"] } template { env = true data = <<EOF {{ with secret "database/creds/production" }} DB_USERNAME={{.Data.username}} DB_PASSWORD={{.Data.password}} {{ end }} EOF } } } } ``` edit: thanks HN formatting
- quinndiggity 6y ago
  with this setup, Vault will create a new database user based on the configuration you set (read-only for some services, for example), and will attach a time-to-live to those credentials; as long as the application is using them, it will renew the TTL. When an application is killed, or scaling happens, etc, and the application instance isn't using those specific credentials, Vault will clean up and remove the unused account cleanly Can do all sorts of great things with this; for example TLS (ssl) certificate renewals, etc, as the certificate expiry IS the TTL; when a certificate needs to be renewed it can happen automatically and your application can receive any signal you choose (SIGHUP, for example)
  - shay_ker 6y ago
    Fascinating! Thanks for sharing, I had no idea this was possible.