Automating Vault deployments: Patterns, pitfalls, and practical lessons
summary
Dockerized Vault runs on OpenStack using Docker Swarm, provisioned by Terraform, configured by Ansible, and orchestrated with Python scripts and Jenkins; seven reusable Terraform modules stand up OpenStack VMs, KV v2 mounts, AppRole and LDAP auth, and generate vault.hcl and Ansible inventories. Backups use full snapshots on replicated Ceph plus Medusa-exported, encrypted mounts to S3. AppRole secret-ID rotation enforces 90‑day TTLs with regeneration at 45 days for 1:1 KV storage. A mid-run state abort once destroyed a dev cluster, so backends and tight state handling are mandatory.
AI-written summary · about
chapters (6)
- 0:00Introduction and agenda
- 1:07Vault at GoDaddy overview
- 8:07Repeatable patterns and modules
- 15:29Challenges and lessons learned
- 24:44Key takeaways and future plans
- 28:12Conclusion and resources
related talks
23mHashiCorp Vault and Getting Day 2 Operations Right
27mVault At Scale
29mAdopting HashiCorp Vault: Deployment, Adoption, and Beyond
41mAutomating Multi-Cloud, Multi-Region Vault for Teams and Landing Zones
28mSelf-Service Vault in Kubernetes
29mOpenStack Plugin for Vault
23mManaging Vault with Terraform
46mVault configuration as code via HashiCorp Terraform - Stories from trenches