Secure Together: Consul + Vault
summary
Combines Consul and Vault to automate mTLS and secret lifecycle: Vault PKI + KV v2 serve as CA and static secret store, with Vault Agent sidecars issuing certificates that Consul dynamically reloads; the demo rotates certs roughly every 20 minutes and still restores connectivity. Uses three-level intermediates to inject SPIFFE URIs for Connect, uses the Vault CSI provider to populate Consul API Gateway TLS, and runs Consul Terraform Sync to auto-create Vault database secrets engines, roles and auth without service disruption.
AI-written summary · about
chapters (9)
- 0:00The challenge of change
- 2:01Vault and Consul synergy
- 3:52Secrets management overview
- 6:51Implementing PKI in Kubernetes
- 11:03Automating server certificates
- 13:40Service mesh PKI architecture
- 19:52API gateway certificate sync
- 30:45Automating dynamic credentials
- 38:56Security automation conclusions
related talks
23mVault for Secrets Management and TLS in Consul K8s
26mCombining DevOps with PKI Compliance Using HashiCorp Vault & Consul
51mIntroduction to Vault
25mConsul Terraform Sync - Awesome Use Cases
38mKeeping Secrets - A Practical Approach to Managing Credentials
38mModern Service Networking With Consul Connect, Envoy and Kubernetes
27mIntegrating Vault and Terraform with Enterprise Machine Identity Services
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes