HashiCorp Vault - Dynamic Database Credentials

[@JohnLovell-FTW]

Thank you for this video! Clear and concise.

[@btkrausen]

Glad you enjoyed it!

[@RafaelDurelli]

Given this example, how can I get the secret inside a POD using external secret operator? Could u please provide a video about it? Thanks in advance.

[@Kk-rl7nv]

Thanks for the video very good video, can you suggest on below Can we use the same scenario for production applications which required RDS database if yes then after or before expiring the credential whether application will retrieve new credentials to keep a continue connectivity with database without any downtime ?

[@MrNoartik]

Thanks for the explanation!

[@btkrausen]

Glad it was helpful!

[@eliekhattar]

Quick question, looking at the config that you wrote for HC , the username and password giving in the config, are superusers on postgresql or what is the role of this user?

[@VinceBaileydns-direct]

Thank you for another great video again. I see that you have courses on Udemy and i am going to purchase those vault training courses this week. I have one question for you in Lou of booking the training courses i have just started a new role which have a 5 node vault server cluster in aws as ec2 instances. I have been asked if we can have a vault agent? Does the vault agent need to be a separate ec2 instances in aws or can it be run on one of the vault server nodes in the cluster? Many thanks for your help i am just going to book your courses now on Udemy

[@btkrausen]

The Vault Agent generally runs alongside of an application to facilitate the communication between the app and the Vault cluster without having to modify the application itself. The Agent can auth to Vault and, for example, grab a secret from Vault and write it locally for the app to read. Or it can set an environment variable using that secret. It's pretty flexible.

[@VinceBaileydns-direct]

@@btkrausen just booked on to your hashicorp vault training course association and professional cert courses

[@VijayaragavanS]

This is really useful! thanks a lot! keep it up!

[@btkrausen]

Glad it was helpful!

[@AdrianHernandez-m5g]

We normally use a parent token to issue this creds under and authenticated backend. My lease period for that parent token is lower than the one that I was using for the actual creds store. The problem that I'm facing as you can imagine is that this token get revoked before the actual lease period expired and I'm using the lease period of the child token to renew the db creds. What do you suggest to address this so common use case? It will be k8s authentication (short lived token) -> database/creds/role (longer ttl)

[@venkatasubbareddyn17]

at 4:41, i have created a vault instance in aws, and also created RDS databse (postgresql ) in aws, i followed same steps but unfortunately unable to connect to the databse. Cuuld you please let me know how to enable to ports to connect vault to AWS RDS (postgresql), created the both vault and AWS RDS instances in same regions only.

[@btkrausen]

RDS should have the default PostgreSQL ports available. Make sure your security groups permit the connectivity and routing is configured between Vault and RDS.

[@VijayaragavanS]

This is really useful! thanks a lot! keep it up!

[@btkrausen]

You're welcome!