search

hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management
https://www.vaultproject.io/
Other
30.94k stars 4.18k forks source link

Pluggable HABackend #610

Closed sepiroth887 closed 9 years ago

sepiroth887 commented 9 years ago

I realized when building the Azure backend that it's not able to run HA without locking/leader election. This is not really great for a production environment...

Any opinions on a pluggable HABackend for any storage backend? I.e.

For cloud storage providers add the HA functionality of consul/zookeeper/etcd as a drop-in when reading the config and enabling HA if a consul/zookeeper/etcd config section is included in the normal storage backend config:

backend "azure" { container = "alksdjla" accountName = "aajsdksj" accountKey = "jakshdajks" ha "zookeeper" { address = "127.0.0.1:2181" path = "vault" } }

jefferai commented 9 years ago

I think the question then is "why not simply use the actual HA backend"? If you already need to set up a cluster of Consul/ZK/etcd in order to enable this that's 95% of the work.

I realize that there are some use cases around "we want leader election but we don't want to store things locally" -- but in that case you could simply do one of those backends in EC2 instances backed by S3, or the equivalent in Azure.

sepiroth887 commented 9 years ago

I think the biggest issue for me would be that i still need to backup zookeeper/consul while at least with azure i get async replication and 3 acks synchronously which eases the mind of a lot of coworkers ;)

jefferai commented 9 years ago

I guess my suggestion was that if you ran one of the HA backends within Azure machines with its backing store, you'd get the same capabilities, including the ability to snapshot.

sepiroth887 commented 9 years ago

:D practical thinking. Yea i keep forgetting those disks are blob backed.

jefferai commented 9 years ago

Related to #395