Video of presentation: https://www.hashicorp.com/resources/streamline-secrets-management-with-vault-agent Learn about the new features in the open source Vault 0.11 release with Jeff Mitchell, an engineering manager at HashiCorp. The new features include ACL templates, namespaces (Vault Enterprise), and Vault Agent, which solves the "secret zero" problem.

1. Copyright © 2018 HashiCorp
Vault Agent and 0.11
Features

2. Copyright © 2018 HashiCorp
• Agent (OSS)
• Namespaces (Enterprise)
• ACL Path Templating (OSS)
Overview
2

3. Copyright © 2018 HashiCorp
• Agent (OSS)
• Namespaces (Enterprise)
• ACL Path Templating (OSS)
Overview
3

4. Copyright © 2018 HashiCorp
• New mode of operation for Vault binary (‘vault agent’)
• Useful for when a client-side daemon is needed (vs single request)
Agent
4

5. Copyright © 2018 HashiCorp
• Automatically authenticates to Vault
• Keeps token renewed, re-authenticates as needed
• Designed with robustness and fault/failure tolerance in mind
• Currently supports AliCloud, AWS, Azure, GCP, JWT, Kubernetes
Auto-Auth

6. Copyright © 2018 HashiCorp
• In terms of flow:
• Auth Handler
• Auth Method
• Sink Server
• Token Sinks
Auto-Auth Design

7. Copyright © 2018 HashiCorp
• If no token, or token invalid, invokes the Auth Method for
instructions on how to authenticate
Auth Handler

8. Copyright © 2018 HashiCorp
• Returns information on how to perform the authentication
• Ready-to-execute HTTP request; address, headers, params
• Very similar to existing CLI helpers for vault login commands
• Can optionally poke the Auth Handler to tell it that new credentials
are available for use
Auth Method

9. Copyright © 2018 HashiCorp
• Uses the Vault Go SDK’s Renewer primitive to keep the returned
token renewed
• When the Renewer can no longer renew, asks the Auth Method to
reauthenticate
• Passes the token to the Sink Server
Auth Handler

10. Copyright © 2018 HashiCorp
• Responsible for fanning out the token to one or more Token Sinks,
as well as some special handling
• On failure, will keep re-attempting, with a backoff
Sink Server

11. Copyright © 2018 HashiCorp
• Responsible for outputting a token somewhere
• Currently just “file”
• Eventually:
• Socket?
• API request?
• Etc.
Token Sinks

12. Copyright © 2018 HashiCorp
• Simple test program:
• Generates a signing key
• Adds the JWT method to Vault, configures the allowed public keys
• On each press of Enter, creates and writes a new JWT
• Agent:
• Configured for JWT flow
• JWT auth method watches for new file, reads it, deletes it
• Auths to Vault
• Keeps tokens renewed/reauths
Demo

13. Copyright © 2018 HashiCorp
• Basics
• Drop onto a ramdisk (preferably encrypted)
• Use filesystem permissions
• Agent has a few options for additional protection; see docs
Protecting Tokens

14. Copyright © 2018 HashiCorp
• Vaults within Vault(s) (within Vault(s))
• Partitions off areas of Vault into nearly fully-separate instances
Namespaces

15. Copyright © 2018 HashiCorp
Root

16. Copyright © 2018 HashiCorp
Teams + Groups

17. Copyright © 2018 HashiCorp
Application/Users

18. Copyright © 2018 HashiCorp
• Shared:
• Underlying encryption keys
• Replication*
• Per-namespace:
• Mounts / Plugins
• Policies
• Tokens
• Leases
• Identities
Namespaces

19. Copyright © 2018 HashiCorp
• Control flows down from the root to the leaves
• Parent namespaces can be given privileges in child namespaces
• Direct ACL path-capability grants
• Identity groups
• Every request executes in the context of the most specific
containing namespace
• Policies operate at their appropriate namespace, always
Namespaces

20. Copyright © 2018 HashiCorp
• Namespaces get special versions of special mounts
• Cubbyhole, Sys, Identity
Namespaces

21. Copyright © 2018 HashiCorp
• Demo time!
Namespaces

22. Copyright © 2018 HashiCorp
• Allows templating Identity values into ACL policy paths
• Easiest to show in a demo…
ACL Policy Path Templating

23. Copyright © 2018 HashiCorp
• Demo time!
ACL Policy Path Templating