Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HashiCorp Boundary

hashicorp.com

Post reply on HN
Print view View original

141–150 of 171 posts

Re: HashiCorp Boundary

#141

Post by jefferai »

talawahtech wrote: post #115
mitchellh wrote: post #11

Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…

What is used to secure/encrypt the connection between the clients and the workers? I did a quick search in the GitHub repo for WireGuard and didn't get any results so I guess you aren't using it.

Check out https://www.boundaryproject.io/docs/concepts/security/connec... for lots of details!

Re: HashiCorp Boundary

#142

Post by debaserab2 »

newman314 wrote: post #98
NovemberWhiskey wrote: post #88

Earlier quoted context omitted.

Hi Mitchell: what's your competitive landscape with Boundary? When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

I think there may be some overlap with Amazon Systems Manager too.

Re: HashiCorp Boundary

#143

Post by malnick »

nikisweeting wrote: post #119

Any example snippets of what the connection setup looks like on the server side? e.g. something like a docker-compose sidecar exposing an nginx container to users via boundary would really help me understand how this is supposed to be used in practice. Looking for an example like my comparison here between argo, wireguard, tailscale, letsencrypt, caddy, and ssh ingress: https://gist.github.com/pirate/1996d3ed6c5872b1…

While we don't have a docker compose example (yet), I think the diagram in our reference architecture for AWS might be useful in visualizing a HA deployment and how a client connects to targets: https://github.com/hashicorp/boundary-reference-architecture

Re: HashiCorp Boundary

#144

Post by theptip »

all_usernames wrote: post #101
newman314 wrote: post #98

Earlier quoted context omitted.

So I've been casually doing some research into this in the past and was just updating my list so here's what I have so far. If I have missed any, please let me know. * Azure App Proxy * Google IAP * Amazon WorkLink * Cloudflare Access * Zscaler Private Access * Duo Beyond * Hashicorp Beyond

Google BeyondCorp?

IAP is Google’s concrete implementation/product, BeyondCorp is the overall philosophy (not a product)

Re: HashiCorp Boundary

#145

Post by ptman »

btgeekboy wrote: post #140
mmettler wrote: post #131

Another company to watch here is Tailscale, which is Wireguard-based: https://tailscale.com/ (disclosure: small Tailscale investor)

I like the people behind Tailscale, but I’ve yet to figure out how they’re different than ZeroTier.

Based on hearsay:

* wireguard (faster) * easier * more stable

Re: HashiCorp Boundary

#146

Post by spockz »

What is it this exactly adds on top of an authenticating reverse proxy like nginx? Is it the rbac to grant access to specific resources based on their labels instead of per hostname/servicename auth?

Re: HashiCorp Boundary

#147

Post by [deleted] »

francislavoie wrote: post #107
windexh8er wrote: post #104

Earlier quoted context omitted.

RBAC is paid for, but "Enterprise SSO" is different than the SSO supported in the Community Edition - it's described on their site as: "SSO with Enterprise Identity". They list: Okta, Sailpoint, Active Directory, OneLogin, G Suite, and Auth0 as examples. But, you still get SSO in Community Edition.

My company self-hosts LDAP, so that's essentially a dealbreaker for us.

[deleted]

Re: HashiCorp Boundary

#148

Post by tpetry »

save_ferris wrote: post #32
candiddevmike wrote: post #23

Earlier quoted context omitted.

> * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of people because we feel it's the right way to think about access control. Note: of course as as a company we plan on commercializing Boundary at some point, but we'll do this similarly to Vault, th…

> I wish you operated more like other, real, open source companies that use subscriptions or managed service offerings and don't lock features behind various obscure pricing tiers. "I want all of the functionality I want without having to pay for it." I hate how discussions around software businesses so often descend into purity tests around how much a company chooses to give away. Software is indeed eating the world…

The problem is not not wanting to pay for software. Hashicorp enterprise products have very interesting features which the open source code is lacking (e.g. nomad namespacing) but they are insanely expensive so you are forced to use the open source versions as the enterprise versions are targeted at fortune x companies.

Re: HashiCorp Boundary

#149

Post by talawahtech »

jefferai wrote: post #141
talawahtech wrote: post #115

Earlier quoted context omitted.

What is used to secure/encrypt the connection between the clients and the workers? I did a quick search in the GitHub repo for WireGuard and didn't get any results so I guess you aren't using it.

Check out https://www.boundaryproject.io/docs/concepts/security/connec... for lots of details!

Thanks! That is exactly what I was looking for.

Re: HashiCorp Boundary

#150

Post by tetha »

jaquers wrote: post #102
mike-cardwell wrote: post #72

Earlier quoted context omitted.

Argh. I already find it a nightmare to figure out how to combine hashicorp tools together. Now there's one more! ;) E.g, if I want a Consul backed Vault, whilst using Vault to generate TLS certs or other creds for Consul. Especially if I want to run either/both of those services using Nomad, backed by Consul. Hopefully I wont have the option of authenticating against any of these services using Boundary. Especially i…

This comment resonates with me so hard. Specifically TLS certs, private certificate authorities and Consul. Like I wanna run my PCA out of Vault (right?), but if using Consul as the backend how do I bootstrap? Sounds like the reply from Michael seems to suggest running the integrated backend, which I can get behind.

Yep, we use the integrated vault backend.

In our case, we use lets encrypt to get certificates for vault and then bootstrap a vault cluster with internal storage. Then you have vault and you can use terraform to configure a consul TLS backend.

And then there is a little hitch, because consul-template cannot easily create multiple files from a single vault API call, so you cannot use consul-template directly to create the necessary certificate files. We've written a small messy tool there. But once you have that, it's fairly straight forward to generate consul + nomad TLS certs for the trust and then you're set.

Post reply on HN