Earlier quoted context omitted.
Maybe you’re not using Terraform. I suspect that your problem is an insufficient usage of HCL.
All hail Hashi-stack!
[deleted]
HashiCorp Boundary
81–90 of 171 posts
Re: HashiCorp Boundary
#82Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…
Argh. I already find it a nightmare to figure out how to combine hashicorp tools together. Now there's one more! ;) E.g, if I want a Consul backed Vault, whilst using Vault to generate TLS certs or other creds for Consul. Especially if I want to run either/both of those services using Nomad, backed by Consul. Hopefully I wont have the option of authenticating against any of these services using Boundary. Especially i…
Indeed. Our recommendation with Vault now is to use the built-in storage[1] to break that dependency. If you must use Consul, we recommend separate clusters.
One way we're simplifying this a lot for people is the introduction of our managed services[2][3]. We understand not everyone can use a managed service though!
Boundary will integrate fairly deeply with Consul/Vault but these integrations will be optional.
[1]: https://www.vaultproject.io/docs/configuration/storage/raft [2]: https://www.hashicorp.com/blog/hcp-consul-public-beta [3]: https://www.hashicorp.com/blog/vault-on-the-hashicorp-cloud-...
Re: HashiCorp Boundary
#83Earlier quoted context omitted.
Argh. I already find it a nightmare to figure out how to combine hashicorp tools together. Now there's one more! ;) E.g, if I want a Consul backed Vault, whilst using Vault to generate TLS certs or other creds for Consul. Especially if I want to run either/both of those services using Nomad, backed by Consul. Hopefully I wont have the option of authenticating against any of these services using Boundary. Especially i…
Indeed. Our recommendation with Vault now is to use the built-in storage[1] to break that dependency. If you must use Consul, we recommend separate clusters. One way we're simplifying this a lot for people is the introduction of our managed services[2][3]. We understand not everyone can use a managed service though! Boundary will integrate fairly deeply with Consul/Vault but these integrations will be optional. [1]:…
Thanks for the response. My comment was half in jest, but it has been a pain point for me.
Re: HashiCorp Boundary
#84Looks like Google's BeyondCorp: https://cloud.google.com/beyondcorp . If you are on GCP, you can already use it https://cloud.google.com/iap to protect your HTTP and TCP backend. This is not something new. The earliest open source project that I can recall is https://github.com/bitly/oauth2_proxy (albeit it might be missing the part where proxy passing identity to the backend). Pomerium is another open source project…
Since you mentioned you're a contributor to a similar project, I invite you to check our recently released zero trust service access control solution: https://github.com/seknox/trasa
It's a BeyondCorp like a user identity and layer 7 aware access proxy for RDP, SSH, Web, and Database protocols with privileged access management, native two-factor auth agents, and device trust policies.
Disclaimer: I am a core maintainer of this project.
Re: HashiCorp Boundary
#85Looks like Google's BeyondCorp: https://cloud.google.com/beyondcorp . If you are on GCP, you can already use it https://cloud.google.com/iap to protect your HTTP and TCP backend. This is not something new. The earliest open source project that I can recall is https://github.com/bitly/oauth2_proxy (albeit it might be missing the part where proxy passing identity to the backend). Pomerium is another open source project…
Even if they were the same a big difference is that Hashicorp tools usually work on prems and are OSS.
By default I expect google to try to lock me in the GCP and do not trust their OSS tools
Re: HashiCorp Boundary
#86Earlier quoted context omitted.
Some people felt burned by Vault where it looked like the free version could be used in production but it couldn't and then the enterprise version is very expensive.
Why can't the free version of Vault be used in production?
Production-worthiness depends on your needs. The free edition is perfectly good for most people, however there are several features and modules that are only available in the Enterprise Edition. Notably, some of the disaster recovery, scaleout, and multifactor authentication features cost extra.
Re: HashiCorp Boundary
#87> With Boundary, access is based on the trusted identity of the user, rather than their network location. The user connects and authenticates to Boundary, then based on their assigned roles they can connect to available hosts, services, or cloud resources. Is this the main idea behind BeyondCorp and CloudFlare One, as well? If so this is the clearest explanation I've seen of it.
It is and it's something I noted, too.
Re: HashiCorp Boundary
#88Hello HN! I'm the founder of HashiCorp. I'm excited to see Boundary here! I want to note a few things about Boundary, why we made it, why it is different than other solutions in the space, etc. * Boundary is free and open source. Similar to when we built Vault, we feel like the solution-space for identity-based security is too commercialized. We want to provide access to this type of security to a broader set of peop…
Hi Mitchell: what's your competitive landscape with Boundary?
When I first looked at the product description, I thought I might be looking at a "zero-trust identity-aware-proxy" sort of thing, but as I read more I got more of the "privileged access management" vibe with more of a focus on controlling access to infrastructure for developers vs. applications for end users.
Re: HashiCorp Boundary
#89Looks like Google's BeyondCorp: https://cloud.google.com/beyondcorp . If you are on GCP, you can already use it https://cloud.google.com/iap to protect your HTTP and TCP backend. This is not something new. The earliest open source project that I can recall is https://github.com/bitly/oauth2_proxy (albeit it might be missing the part where proxy passing identity to the backend). Pomerium is another open source project…
Also looks very much like Gravitational Teleport [0], which has been amazing to use. Teleport has a lot of advantages over Boundary right now based on it's architecture. But Hashi does a good job of iterating quickly, so I'd guess as with most of their products, it evolves quickly. [0] https://gravitational.com/teleport/ Disclaimer: I have no affiliation with any of these companies.
Looks like RBAC and SSO are paid features with Teleport (but I may be misunderstanding)
Re: HashiCorp Boundary
#90Honest question: how is it different/better than setting up a OpenVPN server ?