Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

121–130 of 171 posts

Re: HashiCorp Boundary

#121

Post by samcat116 »

newman314 wrote: post #98
NovemberWhiskey wrote: post #88

Earlier quoted context omitted.

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

Okta Advanced Server Access https://www.okta.com/products/advanced-server-access/

Re: HashiCorp Boundary

#122

Post by ztjio »

mitchellh wrote: post #94
lifty wrote: post #93

Earlier quoted context omitted.

Hey Mitchell, congrats on the new announcements, great stuff! Out of curiosity, how are you building and operate HCP? Are you running it on top of Kubernetes or Nomad, or you're doing some other custom stuff?

- Full HashiCorp stack (Nomad, Consul, Vault, Terraform) - Cadence (https://temporal.io/) - Microservice architecture over gRPC and Consul Connect - All services written in Go - Customer clusters are created/managed by programmatically running Terraform using just-in-time cloud credentials from Vault - All internal TLS certs for customer clusters dynamically created using Vault - All external TLS certs for customer c…

Just for clarification, is "Cadence" a thing you built with Temporal? I see nothing on that site called "Cadence".

Re: HashiCorp Boundary

#123

Post by [deleted] »

newman314 wrote: post #98
NovemberWhiskey wrote: post #88

Earlier quoted context omitted.

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

[deleted]

Re: HashiCorp Boundary

#124

Post by cbsmith »

yegle wrote: post #8

Looks like Google's BeyondCorp: https://cloud.google.com/beyondcorp . If you are on GCP, you can already use it https://cloud.google.com/iap to protect your HTTP and TCP backend. This is not something new. The earliest open source project that I can recall is https://github.com/bitly/oauth2_proxy (albeit it might be missing the part where proxy passing identity to the backend). Pomerium is another open source project…

...and they all looks like SOCKS5 proxies...

Re: HashiCorp Boundary

#125

Post by mfateev »

ztjio wrote: post #122
mitchellh wrote: post #94

Earlier quoted context omitted.

- Full HashiCorp stack (Nomad, Consul, Vault, Terraform) - Cadence (https://temporal.io/) - Microservice architecture over gRPC and Consul Connect - All services written in Go - Customer clusters are created/managed by programmatically running Terraform using just-in-time cloud credentials from Vault - All internal TLS certs for customer clusters dynamically created using Vault - All external TLS certs for customer c…

Just for clarification, is "Cadence" a thing you built with Temporal? I see nothing on that site called "Cadence".

Temporal is the fork of Cadence by the original creators.It is still open source under MIT license.

I'm former creator and tech lead of Cadence and currently tech lead of Temporal.

Re: HashiCorp Boundary

#126

Post by pferde »

jmccarthy wrote: post #105
pferde wrote: post #97

Earlier quoted context omitted.

StrongDM does indeed look interesting. Can it be completely self-hosted? I am asking because some of the architecture docs mentioned "app.strongdm.com" as a necessary element, which has a webpage behind a (customer?) login. This is an external dependency that is not acceptable for my use case. I haven't found a conclusive answer in their documentation yet.

Justin here, co-founder and CTO of strongDM. The policy and audit functions of our product are hosted by us, but all the sensitive data transit - the proxies themselves - are hosted by you. Hope that helps!

Thanks for the reply, I really appreciate it. Unfortunately, that is not acceptable for what I had in mind.

Re: HashiCorp Boundary

#127

Post by outworlder »

luminousbit wrote: post #62

Personally I’ve been a big fan of strongDM ( https://www.strongdm.com/ ). Lightyears ahead of teleport or any of the other solutions out there. Built for great auditing and zero trust. Best of all it’s multi-protocol. So you can do SSH, SQL, K8s, HTTP all with one access system. Had it in prod for almost two years. Gonna be a long time before hashicorp or anyone else can catch up with the level of depth.

> Best of all it’s multi-protocol. So you can do SSH, SQL, K8s, HTTP all with one access system.

Teleport is SSH based so you can tunnel other protocols.

Re: HashiCorp Boundary

#128

Post by outworlder »

wyck wrote: post #16

With a name like HashiCorp I expected this to be a decentralized blockchain identity network similar to IBM's Sovrin, still really cool though, managing id's and permissions is such a pita.

Hashicorp is behind Terraform, Vault, Consul, Nomad. Surely you have heard of at least one of those?

Re: HashiCorp Boundary

#129

Post by scarlac »

fasteo wrote: post #90

Honest question: how is it different/better than setting up a OpenVPN server ?

VPN clients traditionally virtualizes your network interface entirely. Everything acts as if your are actually physically present because it's virtualized nicely. It's great because it "just works".

These "non-VPN" solution seem to use a client on your machine that change any DNS lookup through the OS layer by hooking into gethostaddr() and returning the same IP for all domains if they are in the list of hosts that should be virtualized. Then only the traffic to domains that are needed is virtualized, anything else is untouched. YouTube and Netflix won't get piped over your company network, as an example.

Disclaimer: I don't really know that this is how it works but this is how other providers do it.

Re: HashiCorp Boundary

#130

Post by digitallogic »

mitchellh wrote: post #120
digitallogic wrote: post #117

Earlier quoted context omitted.

> Customer clusters are created/managed by programmatically running Terraform I have soooo many questions about best practices doing this. I run a service that needs to dynamically provision AWS resources, and lacking a clear path to do this programmatically, I shell out to Terraform. * I assume you aren't shelling out :). Do you have any additional helper libraries on top of the Terraform code base to make it more o…

Yeah this isn't very easy to get right at the moment so there is not going to be any silver bullet here. We had to iterate on our runner a lot to get this right, but we have a lot of experience since we do this for Terraform Cloud too. Answering your questions: > * I assume you aren't shelling out :). Do you have any additional helper libraries on top of the Terraform code base to make it more of a a programmatically…

>> * I assume you aren't shelling out :)...

>>

> We in fact are.

Words can not express the joy I feel in reading this. Thanks so much for the responses!

Post reply on HN