Running HashiCorp Vault in Production

Description

Flexibility and security. Two characteristics that cannot be compromised in the age of multi-cloud and DevOps, yet most secrets management tools were designed around the idea that both cannot be achieved together. Enter HashiCorp Vault, built around the philosophy that securing secrets is more effective when the interaction of a secrets management service aligns with other DevOps tools available today. Vault has quickly become the de-facto solution in secrets management over recent years, finding its way into many Global 2000 companies. This book will cover multiple aspects of Vault, from planning the service, architectural design, and deployment of Vault, to managing the service once it is up and running. With a combined 40 years of experience working in technology and more than three years working specifically with Vault, Bryan and Dan walk users through the process of designing and building a production-ready Vault service. NOTE: Paperback copies will be available the same day as the Kindle version. If your prefer a paperback copy, please wait till the release date to order. Preface Acknowledgements About the Authors Bryan Krausen Dan McTeer Foreword – by Armon Dadgar 1. Introduction to HashiCorp Vault How Vault Works The Basic Components Paths Secrets Engines Auth Methods Tokens Policies The Vault Service Process Phase 1 - Preparation Phase 2 - User Interaction Phase 3 - Cleanup Interacting with Vault The Vault API Vault Interfaces Using the API Using the CLI Using the Web UI General Consumer Interaction Administrative Interaction Security and Compliance Interaction Programmatic Interaction 2. Planning A Vault Deployment Gathering Requirements Business Requirements Technical Requirements Security Requirements End-User Requirements Requirements Gathering Process Service Level Objectives and Indicators Determining Service-Level Objectives Mapping Service-Level Indicators Service-Level Reporting Designing the Vault Architecture Fault Tolerance Vault Clustering Accessing the Vault Service Node Placement Storage Backend Integrated Storage Consul Storage Backend Replication Design Disaster Recovery (DR) Replication Performance Replication Choosing Between Replication Types Single Cluster Multi-Cluster - Single Region/Data Center Redundancy Scale Limitations Multi-Cluster - Multiple Regions/Data Centers Redundancy Scale Disaster Recovery Integrated Storage Consul Storage Finalizing the Deployment Plan Preparation Building the Foundation Deploying Vault Choosing the Support Team Support Team Experience Site Reliability Engineer - Required Experience DevOps Engineer - Required Experience Senior DevOps Engineer Team Composition Support Phases Phase One Phase Two Phase Three Phase Four Staffing Recommendations 3. Building a Vault Service Foundation Operating System Configuration System Hardening Configure /tmp Disable Auto-Mounting (autofs) Configure SSH Service Accounts Local User Accounts Disable Command History Disable Core Dumps Additional Configuration Log Rotation Configuration Management Building a Base Image Maintaining a Base Image Deployment Vault Service Configuration Vault Configuration File Storage Backend Listener Seal Type Additional Parameters Putting It All Together Vault Service Configuration Vault User Vault Service File Monitoring and Alerting for Vault Operational Monitoring Telemetry System Logs Audit Log Security Monitoring Performance Monitoring Tracer Bullets Automating Vault Operations Tools for Success Automated Deployments Configuration Management Service Validation New Build Validation Service Benchmarking Feature Validation Data Restoration Automated Deployments Configuration Management Service Validation New Build Validation Service Benchmarking Feature Validation Data Restoration