Hashicorp Vault - Human vs. system auth methods - AppRole Pull Authentication - #3

Hashicorp Vault - Human vs. system auth methods - AppRole Pull Authentication - #3

Chapters:
00:00 About
00:29 Vault Architecture recap
01:17 Vault Authentication Methods recap
03:12 Differentiate human vs. system auth methods
05:00 AppRole Authentication methods
06:42 AppRole Pull Authentication Steps & usage
10:42 Demo - AppRole Pull Authentication

Documentation:

Vault Server Github:

Connect with me on Slack:

Like, Comment & Subscribe Learn with GVR

#cks #hashicorpvault #vault #k8s #learnwithgvr

[VasyChristmas]

Thank you kindly for your presentation. We are just implementing vault for storing and delivering secrets. This video is very useful.

[jaybotha]

Thank you very much for this video it helped alot.

[Mrnw]

Thank you for doing this, really well explained!

[amarjitkumar]

Thank you very much... Explained things in very good way. Cleared lots of my doubt. Do you have any example of accessing vault from spring boot application.

[OumaymaJERBI-xiyn]

Very good presentation thank you 😊 should we give the application (Jenkins) the roleID and the secretID to authentificate or the generated token ?

[rubyashby]

Very good presentation…. Thanks you so much!

[arafatkatze]

Thanks a lot. This is such a good explaination.

[Techwolf]

What is the name of the terminal you are using that is caching your previously used commands while showing them as well or where do I go to either download it or install it? I think it's pretty cool and helps to quickly reference your session history.

[seanriley]

Thank you. This is a fantastic explanation. However I have a question.

You need to give your "Jenkins" application the RoleID and the SecretID. With those values you can get the token (which in your example only lasts 1 hour) and with that token you have access to the secrets in teh vault. However, anybody with access to your application config (I guess where you would keep the RoleID and SecretID) would also then have access to the secrets in the vault (by logging in via the CLI as you demonstrated). Surely this is not secure.

So my question is what is the best practice for keeping the RoleID and the SecretID protected? Obviously hardcoding them into your app is not an option also an environment variable is not really an option either (unless you are running in the could I guess)

[WilsonMar]

What is the URL of the #1 and #2 referenced here?

[santoshganji]

Hello, Everyone

Can any one know how we can leverage Hashicorp vault with ssh password less mechanism with approle auth method.
Just on a high level with real time example.

[maheshreddy]

Hi, can you please do tutorial on PKI secrets engine