Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

111–120 of 171 posts

Re: HashiCorp Boundary

#111

Post by hossi »

newman314 wrote: post #98
NovemberWhiskey wrote: post #88

Earlier quoted context omitted.

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

* PrivX by SSH.COM

We provide a lean PAM solution for multi-cloud infrastructure access.

Re: HashiCorp Boundary

#112

Post by mitchellh »

TheGuyWhoCodes wrote: post #103
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Are there any plans or a way to use existing tools? By existing tools I mean winscp or any other tools that use a normal ssh client? RDP etc. I guess for shh and rdp you can just run the Boundary cli with a the predefined target in a terminal embedded into the UI (MremoteNG, MobaXterm etc) but tools like winscp are very much used for sftp file transfers. A desktop client with a list of services/targets would also be…

You can do this already, The `boundary connect ssh` stuff is just a convenience. You can spin up a local boundary proxy to anything and just connect anything that speaks TCP over it. This allows you to use all the tools you just named.

A desktop client is on the way, we already have an internal build of parts of it but it requires more work and didn't make it for 0.1.

Re: HashiCorp Boundary

#113

Post by nielsole »

newman314 wrote: post #98
NovemberWhiskey wrote: post #88

Earlier quoted context omitted.

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

* Teleport https://gravitational.com/teleport/

Re: HashiCorp Boundary

#114

Post by mitchellh »

jcims wrote: post #96
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

Thinking of this as a means for privileged access management, would it be possible for Boundary to gather artifacts (e.g. keystroke logs and/or screen shots) from the session? This might trigger some folks but have you explored any options for delivering some or all of the Boundary infrastructure through serverless/faas?

Yes this is on the roadmap!

Re: HashiCorp Boundary

#115

Post by talawahtech »

mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

What is used to secure/encrypt the connection between the clients and the workers?

I did a quick search in the GitHub repo for WireGuard and didn't get any results so I guess you aren't using it.

Re: HashiCorp Boundary

#116

Post by chucky_z »

jaquers wrote: post #102
mike-cardwell wrote: post #72

Earlier quoted context omitted.

Argh. I already find it a nightmare to figure out how to combine hashicorp tools together. Now there's one more! ;) E.g, if I want a Consul backed Vault, whilst using Vault to generate TLS certs or other creds for Consul. Especially if I want to run either/both of those services using Nomad, backed by Consul. Hopefully I wont have the option of authenticating against any of these services using Boundary. Especially i…

This comment resonates with me so hard. Specifically TLS certs, private certificate authorities and Consul. Like I wanna run my PCA out of Vault (right?), but if using Consul as the backend how do I bootstrap? Sounds like the reply from Michael seems to suggest running the integrated backend, which I can get behind.

So I actually do this today, and I use Vault. This sounds weird, but I spin up a "bootstrap PKI" Vault that is local-only, and produces, e.g.: "consul.service.dc.consul" certs with the issuer labeled as "bootstrap PKI intermediate" or some such. I generate a full suite of these for everything in a space, get it all up and running, then there's a 2nd layer of automation where self-certs are issued.

That said, I'm moving to a central distributed Vault that is mostly going to exist as a PKI so I'll only really need to repeat this process once more! Going to be using the raft internal engine for this one, and spread it physically across the globe so performance is going to be pretty terrible by design, but it should be quite resilient!

Re: HashiCorp Boundary

#117

Post by digitallogic »

mitchellh wrote: post #94
lifty wrote: post #93

Earlier quoted context omitted.

Hey Mitchell, congrats on the new announcements, great stuff! Out of curiosity, how are you building and operate HCP? Are you running it on top of Kubernetes or Nomad, or you're doing some other custom stuff?

- Full HashiCorp stack (Nomad, Consul, Vault, Terraform) - Cadence (https://temporal.io/) - Microservice architecture over gRPC and Consul Connect - All services written in Go - Customer clusters are created/managed by programmatically running Terraform using just-in-time cloud credentials from Vault - All internal TLS certs for customer clusters dynamically created using Vault - All external TLS certs for customer c…

> Customer clusters are created/managed by programmatically running Terraform

I have soooo many questions about best practices doing this. I run a service that needs to dynamically provision AWS resources, and lacking a clear path to do this programmatically, I shell out to Terraform.

* I assume you aren't shelling out :). Do you have any additional helper libraries on top of the Terraform code base to make it more of a a programmatically consumable API, as apposed to an end user application?

* Are you still pointing at a directory with resources defined in HCL, or are the resources defined programmatically?

* What are you using for state storage?

* What is the execution environment for the programmatic Terraform process? Since Terraform uses external processes for plugins, I've hit some issues with resource constraints around the max number of process sysctl's in containerized environment where I have multiple Terraform processes running in the same container.

edit: formatting

Re: HashiCorp Boundary

#118

Post by malnick »

candiddevmike wrote: post #25

It looks like you still have to manage users on the hosts for PAM, including SSH keys (or use Vault I suppose). It's too bad that this can't perform all of that functionality--setup a server, install a boundary client, and manage all of the PAM things through Boundary.

We plan on integrating with Vault to perform transparent credentials injection in the not so to distant future. This is a 0.1 product after all, and we still have a lot to build!

Re: HashiCorp Boundary

#119

Post by nikisweeting »

Any example snippets of what the connection setup looks like on the server side?

e.g. something like a docker-compose sidecar exposing an nginx container to users via boundary would really help me understand how this is supposed to be used in practice.

Looking for an example like my comparison here between argo, wireguard, tailscale, letsencrypt, caddy, and ssh ingress: https://gist.github.com/pirate/1996d3ed6c5872b1b7afded250772...

Re: HashiCorp Boundary

#120

Post by mitchellh »

digitallogic wrote: post #117
mitchellh wrote: post #94

Earlier quoted context omitted.

- Full HashiCorp stack (Nomad, Consul, Vault, Terraform) - Cadence (https://temporal.io/) - Microservice architecture over gRPC and Consul Connect - All services written in Go - Customer clusters are created/managed by programmatically running Terraform using just-in-time cloud credentials from Vault - All internal TLS certs for customer clusters dynamically created using Vault - All external TLS certs for customer c…

> Customer clusters are created/managed by programmatically running Terraform I have soooo many questions about best practices doing this. I run a service that needs to dynamically provision AWS resources, and lacking a clear path to do this programmatically, I shell out to Terraform. * I assume you aren't shelling out :). Do you have any additional helper libraries on top of the Terraform code base to make it more o…

Yeah this isn't very easy to get right at the moment so there is not going to be any silver bullet here. We had to iterate on our runner a lot to get this right, but we have a lot of experience since we do this for Terraform Cloud too.

Answering your questions:

> * I assume you aren't shelling out :). Do you have any additional helper libraries on top of the Terraform code base to make it more of a a programmatically consumable API, as apposed to an end user application?

We in fact are. There are lots of security concerns you have to consider with this. We published a library to make this easier: https://github.com/hashicorp/terraform-exec

> * Are you still pointing at a directory with resources defined in HCL, or are the resources defined programmatically?

HCL mixed with the JSON flavor of HCL for programmatically generated stuff. Variables in JSON format also programmatically generated.

> * What are you using for state storage?

We output it to a file and handle this in an HCP microservice. We encrypt it using the customer-specific key with Vault and store it in a bucket that only the customer-specific credential has access to. If there is an RCE exploit somehow in our workflows, they can only access that customer's metadata.

> * What is the execution environment for the programmatic Terraform process? Since Terraform uses external processes for plugins, I've hit some issues with resource constraints around the max number of process sysctl's in containerized environment where I have multiple Terraform processes running in the same container.

Containers in HCP and VMs in Terraform Cloud due to increased isolation requirements. HCP has less strict requirements because the Terraform configs and inputs are more tightly controlled.

Post reply on HN