Viewing profile — armon

Lock contention is a real issue for any multi-threaded system, and while a RW mutex is useful when you have a longer executing critical section, for something very short lived ther…

We use HCL broadly across the HashiCorp portfolio. It was popularized by Terraform, but also used in Vault, Consul, Nomad, and Packer. Important to note, that HCL is designed to be…

We've continued to grow the Nomad team, and are working towards the big 1.0 release milestone later this month. The OSS usage continues to grow double digit every quarter and our c…

You would point the application at the local port. It operates very similarly to SSH port forwarding. No fancy magic to intercept all traffic.

We don't have a white paper on this yet, but we have a white board video that explains both how it works conceptually as well as at a more technical level of deployment architectur…

That is correct! The local proxy has a listening socket and handles all the authentication, encapsulation, and forwarding transparently.

Disclosure: I'm one of the founders of HashiCorp. Glad you found Consul easy to get going with. We definitely focus on enabling K8S as a first class platform. There is documentatio…

HashiCorp ( https://www.hashicorp.com ) | SRE, Software Engineers, Engineering Managers | REMOTE | Full-time HashiCorp builds DevOps tools for modern applications. We build open so…

HashiCorp ( https://www.hashicorp.com ) | SRE, Software Engineers, Engineering Managers | REMOTE | Full-time HashiCorp builds DevOps tools for modern applications. We build open so…

I gave a talk at GoSF about Radix trees, and how they are used heavily in HashiCorp products (Terraform, Consul, Vault, Nomad, etc). The slides are available here for those interes…

Hey, I'm one of the co-founders of HashiCorp. To keep it brief, we are more committed to Nomad today than before. The team has doubled in the last year, and we plan to grow further…

That is exactly right. At the bottom of the blog post we touch on this, but if you are using consul-template to provide secrets via a configuration file, it can either restart or r…

Hey peteski22, Exactly what you suggested would work! Having an AppRole that never expires would allow the trusted orchestrator to authenticate on each run, and then generate and i…

Vault is free and open source. We do have an enterprise product, but all the dynamic secrets capabilities exist in the open source!

There are some good suggestions in the replies here, but I'd recommend looking at our secure introduction guide here: https://www.vaultproject.io/guides/identity/secure-intro.htm..…

When Vault connects to the endpoint system to create a dynamic user, it presents a set of credentials only known to it. You have to authorize Vault to create dynamic users, so a ma…

We work with many Fortune 2000 customers, and having 500K secrets is on the extreme side and most certainly puts you in an infrastructure where you have 50K-100K+ machines under ma…

Kerberos was a major inspiration for us! The goal of Vault was to be a modern Kerberos, but invert the integration model. I think that is the Achilles heel of Kerberos, since it ha…

I'm one of the co-founders of HashiCorp, and I wanted to just chime in on the release. We may have done a disservice in the blog post by highlighting the new features landing in th…

I'm curious if the author was aware of our implementation at HashiCorp ( https://github.com/hashicorp/memberlist ). We use that implementation in Serf ( https://www.serf.io ) to pr…

The used synthetic benchmark is not a great indicator of performance in most (any?) production environments. It's generally useful and interesting to understand the tradeoffs betwe…

I've given a talk at Papers We Love about Bloom Filters ( http://paperswelove.org/2015/video/armon-dadgar-on-bloom-fil... ) for those wanting to learn more. There have been quite a…

The article can probably be succinctly summarized as "Premature optimization is the root of all evil". Most of the authors points are valid, in that caching adds more complexity. T…

To clarify, statsite does spawn threads to do some of the aggregation and flushing at the end of the collection interval, but yes it is possible to saturate the main loop at a very…