search

fmeringdal / do-hashicorp-cluster

MIT License
205 stars 23 forks source link

Identity based access control #2

Open fmeringdal opened 3 years ago

fmeringdal commented 3 years ago

Using PEM files for accessing droplets is not best practice. Vault should be enabled as a CA that can issue short-lived certificates which can be used to access droplets. HashiCorp Boundary could also simplify access management a lot when it releases a Vault integration.

LouisIV commented 3 years ago

I highly recommend looking at this: https://github.com/jsiebens/hashi-up/blob/master/docs/boundary.md. I think it could simply several parts of this repo and you can demo it by trying to setup boundary with it

fmeringdal commented 3 years ago

I dont think Boundary will make sense for this cluster before it has integration with Vault to retrieve SSH keys etc. Also I think Boundary could run in dev mode and be managed by Nomad and that HA of Boundary is not necessary.