Comments (13)
@drnic We removed the script from Concourse due to the security reasons. We didn't want to keep unseal keys in one place and we decided to leave the unsealing part as the manual job. Now we have a Concourse job that checks if any Vault instance is sealed and if yes, then it sends an email notification to key holders.
from vault-boshrelease.
Just an aside, if you use the safe-boshrelease (https://github.com/cloudfoundry-community/safe-boshrelease), then safe seal
and safe unseal
start working and do the magical needful.
from vault-boshrelease.
Are you recommending adding additional health checks above and beyond what the Consul backend provides? Or are you talking about registering with an external Consul instance?
from vault-boshrelease.
Maybe I'm misunderstanding--what I'm trying to ask is how you make sure that clients only talk to unsealed vault instances. If clients look up vault instances via consul dns, then you're already done. Or if clients don't have access to consul, you might use an external load balancer with a health check.
from vault-boshrelease.
I don't think we can make sure that clients only talk to unsealed Vaults, not without explicit Vault-aware support in the client binary / library.
from vault-boshrelease.
An example of Vault-aware client machinery is the forthcoming HA support in safe
, once we finish reviewing and merge this PR: Qarik-Group/safe#45
from vault-boshrelease.
Vault itself doesn't know how to prevent clients from accessing sealed instances, but it does include a health check endpoint that can be used by a load balancer to remove sealed instances from service--that's exactly what the example load balancer in the vault docs at https://github.com/hashicorp/vault/blob/master/terraform/aws/main.tf#L76-L107 is used for. And like I mentioned earlier, if clients use consul dns to find vault instances, the vault.service.consul
name will resolve to all unsealed vault instances. My question is which of those approaches you use to prevent clients from talking to sealed instances, if any. It sounds like the answer is none of the above, but that you're going to solve the issue using your client instead.
In any case, I think it would be useful to include a note on this in the docs, even if only to say that you recommend using safe
, which handles the issue, and that users of different clients will want to solve the problem of sealed instances on their own.
from vault-boshrelease.
I bypassed this issue on AWS by setting a health check on HTTPS:8200/v1/sys/leader which returns 500 only on sealed instances so they are treated by ELB as out of service.
from vault-boshrelease.
We've done similar things with haproxy fronting Vault, but have run into minor issues during the post-update "everything-is-sealed" scenario. How are you solving that in AWS, @simonkey007 ?
from vault-boshrelease.
We have a script that every minute checks all the instances, one by one and unseal them if they are sealed.
from vault-boshrelease.
I wonder if it would be worthwhile to package that up as a post-start or post-deploy script (optional, controlled by vault.auto_unseal: true
in the manifest) or not.
from vault-boshrelease.
@jmcarp @simonkey007 just checking to see if you've looked any further into this; Thanks :)
from vault-boshrelease.
@simonkey007 is your (cron?) script still the solution that works for you?
from vault-boshrelease.
Related Issues (20)
- Upgrade to Vault 0.9.0 HOT 1
- Support Raw Configuration / Eliminate Backends HOT 5
- Cut a new release please! HOT 3
- LDAP Auth Method HOT 1
- Prep Next Release HOT 1
- cluster_address and redirect_address in README.me HOT 4
- post-start failed HOT 10
- vault post-start failed due to SSL check error HOT 3
- Vault HA configurations, how to use, and how it works? HOT 1
- Sample manifest doesn't include generated CA
- Sample manifest does not persist data
- post-start script pass but no changes, vault is sealed HOT 9
- DynamoDB Unmarshal errors HOT 2
- Cut releases for Vault 0.11.1 and 0.11.2? HOT 3
- vault: 0.11.5 released HOT 3
- vault v1.0.1 HOT 2
- vault v1.0.3 HOT 1
- Upgrade to vault 1.4.2 HOT 5
- Hide versioning information HOT 2
- Support for Vault 1.13
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from vault-boshrelease.