vault
HashiCorp Vault: secret storage, dynamic credentials and unsealing.
-
External Secrets with Offline JWT Validation When Vault Cannot Reach the Cluster
Vault kubernetes auth "failed to validate token" tokenreviews i/o timeout: jwt auth with jwt_validation_pubkeys from sa.pub for External Secrets.
-
Auto-Unsealing Vault Without Cloud KMS or a TPM, Using Tang and Clevis
clevis encrypt sss with Tang pins to auto-unseal Vault without cloud KMS or a TPM: binding Shamir key shares, a systemd unit, and the t threshold.
-
Runtime Secret Injection with a Vault Agent Sidecar and a Wrapped AppRole
secret_id_response_wrapping_path in Vault Agent approle auto_auth: a sidecar that bootstraps from a single-use wrapped secret_id and renders secrets to a file.
-
Vault KV-v2: Why put Silently Wipes Every Sibling Field
vault kv put wipes sibling fields and -cas fails with "check-and-set parameter did not match the current version": why, and how patch avoids it.
-
Replacing Distributed SSH Keys with a Vault Certificate Authority
TrustedUserCAKeys with the Vault ssh secrets engine: short-lived SSH user certificates limited by allowed_users and ttl instead of authorized_keys.