HashiCorp Vault Tutorial for Beginners | FULL COURSE in 1 Hour | HashiCorp Vault Fundamentals

[@TeKanAid]

▬▬▬▬▬▬ Announcements📢 ▬▬▬▬▬▬▬ 🔥 If you're interested in a step-by-step course to learn the basics of HashiCorp Vault, check this course out: HashiCorp Vault 101 - Certified Vault Associate ► bit.ly/hc-vault101 In this course you will get to: ⭐ Learn everything you need to know about Vault to ace the Vault Associate Exam ⭐ 8+ hours of video content ⭐ Instructor has his camera on making you feel that you're right in the classroom ⭐ Hand-drawn animated diagrams to help you grasp the topics better ⭐ Lots of hands-on labs to learn by doing ⭐ English closed captions that are searchable so you won't miss a word ⭐ Quizzes to help you grasp the material well ⭐ Join our Community

[@zenobikraweznick]

Uh, man! This is something I've looking for! Explained precisely , no BS, pure knowledge! BIG thanks!

[@TeKanAid]

Glad it helped!

[@davidbuckley4904]

Outstanding! As an IT educator myself, I am impressed with your planning, organization, and delivery. Very well done.

[@TeKanAid]

Wow, thanks a lot, David!

[@S1000rrboy]

Dude holy shit I swear you really explain things so well so clear someone that is a beginner in IT could fully understand this. You rock my guy!!!!!!! Keep making these lessons you are making everyones lives so much easier and not make me feel dumb :)

[@TeKanAid]

Thanks, Jesse, that made my day!

[@merrymouse2008]

Thank you so much for making this tutorial. Now I have a better understanding of the Vault. I am a Junior and it was a struggle for me to actually realise why we use this technology at my job and how it works. Thanks a lot!

[@TeKanAid]

This is wonderful to hear! I'm so glad this helped you!

[@Kengoorkv]

Thanks a lot for this jumpstart course. It gives a lot of clear and concise information

[@TeKanAid]

You're welcome, glad it helped

[@a_maxed_out_handle_of_30_chars]

simple and to the point, thank you :)

[@TeKanAid]

Thank you!

[@ashermanangan]

thanks this is the best channel for devops

[@TeKanAid]

Thank you so much

[@premierde]

Can an External Storage be hooked with Vault. Like External Secrets Operator (ESO) offer association with various external storage provider.

[@TeKanAid]

I think you're talking about two different things. HashiCorp Vault can integrate with external storage providers through its storage backends. These backends are used to persist the data that Vault manages, such as secrets and policies. Here are a few examples of external storage backends that Vault supports:Amazon S3: Vault can use Amazon S3 as a storage backend. You need to configure the S3 bucket and provide necessary credentials.Google Cloud Storage: Similar to S3, Google Cloud Storage can also be used as a storage backend for Vault.Azure Blob Storage: Vault supports Azure Blob Storage as well.Consul: While not strictly an "external" storage provider, Consul is commonly used with Vault for storage and high availability.DynamoDB: Vault can use AWS DynamoDB for storage, which helps in achieving high availability and reliability. In comparison to External Secrets Operator (ESO), which allows you to dynamically fetch secrets from various external secret management services into Kubernetes, Vault's external storage backends are primarily for persisting Vault's own data securely. However, Vault can also serve as a secret management service itself, and its secrets can be accessed by Kubernetes using integrations like the Vault Kubernetes Auth method and the Vault Agent Injector. Vault has a Vault Secrets Operator VSO similar to ESO. developer.hashicorp.com/vault/tutorials/kubernetes/vault-secrets-operator

[@premierde]

@@TeKanAid Many thanks for the explanation. 🙏

[@TeKanAid]

​@@premierdeYou are welcome!

[@jakubk7158]

Great video thanks :), making my life easier

[@TeKanAid]

Thank you for the kind words!

[@ChanceTEK]

Extremely helpful. Thank you.

[@TeKanAid]

Glad to hear

[@didmfu2841]

덕분에 많은 도움을 받았습니다. 감사합니다 :)

[@TeKanAid]

You're welcome!

[@aparnasaraswathi8524]

Hi, My requirement is to implement TDE on DB2, is it possible through Hashicorp vault? Could you please let me know. Thank you!!

[@TeKanAid]

I have seen the use of Vault with TDE on MSSQL and Oracle, but have not seen it with DB2. I can ask the HashiCorp folks.

[@aparnasaraswathi8524]

@@TeKanAid Thanks for the response. Yes I'm researching on it but couldn't able to find any proper documents/solutions

[@adamzachary6947]

Great tutorial. loved it. Thx man

[@TeKanAid]

You're welcome thanks for your note.

[@TomerFatael-dw3yl]

What is the right way to manage the tokens in the secert.txt file? Moreover, what is the right way to manage the token we get from vault after authenticating?

[@TeKanAid]

These are great questions and I cover them all in my Vault 101 and Vault 202 courses, but quickly, the root token should only be used to configure auth methods. One of which should give admin access then you should revoke the root token. You can always recreate a root token from the unseal keys.

[@santanajs]

A very very useful video. Thank you very much for this 😃

[@TeKanAid]

You're very welcome!

[@premierde]

👏 The audit log size keep growing... or? does it get rotated

[@TeKanAid]

You have to use a utility that rotates the logs such as logrotate. You need to be careful because if you run out of disk space, Vault will stop working by design. I talk about all that in depth and give you the config in my Vault 202 course if you’re interested.

[@itvrlogic5600]

Thanks for detailed explanation!

[@TeKanAid]

Glad it was helpful!

[@thiruardura]

Hi, my requirement is to implement MySQL DB with TDE. Can Hashicorp vault used for MySQL DB with TDE? Thanks

[@TeKanAid]

Yes you can use Vault for key management dev.mysql.com/doc/mysql-secure-deployment-guide/8.0/en/secure-deployment-data-encryption.html

[@thiruardura]

@@TeKanAid Thank you.

[@thiruardura]

@@TeKanAid Do you a course that teaches MySQL DB TDE with HashiCorp vault?

[@TeKanAid]

@@thiruardura please send me a note via my contact form I would like to learn more about what you're looking to do. tekanaid.com/contact

[@tamiltechwitharun]

Easy to understand . Thanks

[@TeKanAid]

Glad to hear, thanks!

[@flesz_]

Thanks, does it mean Vault is used as a kind of proxy between client and servers? For example DB server credentials are staying the same, but vault can dynamically create different sets of creds rather than distributing DB credentials to applications. So in that case does it does it somehow works as reverse proxy for the credentials? :)

[@TeKanAid]

Yeah, it acts as a broker for secrets. Dynamic Database secrets are on demand secrets that get created on read from the client.

[@trevorjames3953]

In my project, we use vault to login to different aws and on prem servers. We run the script vault login and it asks prompt we are willing to login like aws/azure/gcp and then it asks prod or np or dev , we shd pass on our creds linked to ldap, otp later which we get while we setup vault for individual thru generated secret. Just info for others

[@TeKanAid]

Thanks for sharing, Trevor!

[@ashermanangan]

i like the visuals!

[@TeKanAid]

Glad to hear, thanks

[@vincentverweij1053]

Hi there, first of all thank you for making and uploading this video. I did learn a lot from Vault's features and setup. I do have a question however, is there a reason why it instantiates (at 40:48) a vault.db file that has a whopping 100GB in size? And if not, is there a way to control this size? Again, thanks for the video!

[@TeKanAid]

Thank you. I hadn't looked into it before. I don't think you can tune it. I came across this learn guide if it's helpful. learn.hashicorp.com/tutorials/vault/performance-tuning?in=vault/operations#storage-backend-tuning

[@vincentverweij1053]

@@TeKanAid thanks for taking the time to reply and advise on this. Came across this documentation too. Tried to add in some config values, but it also seemed to me that you can't control the value. Strange that it takes up so much space. Anyway, thanks again!

[@TeKanAid]

@@vincentverweij1053 I actually took a look and don't see that large of a file. Not sure why you're getting that. (⎈ |docker-desktop:default) Gabrail-Windows:sam:~/Deployment_Linux/Vault/Training/vault-101/Section06-Starting_a_Production_Vault_Server/vault/data$ll total 196K drwxr-xr-x 3 sam sam 4.0K Feb 18 16:53 . drwxr-xr-x 3 sam sam 4.0K Feb 18 16:52 .. drwxr-xr-x 3 sam sam 4.0K Feb 18 16:53 raft -rw------- 1 sam sam 180K Mar 2 17:34 vault.db (⎈ |docker-desktop:default) Gabrail-Windows:sam:~/Deployment_Linux/Vault/Training/vault-101/Section06-Starting_a_Production_Vault_Server/vault/data$du -h ./vault.db 184K ./vault.db

[@femya4572]

excellent teacher

[@TeKanAid]

Thank you!

[@hackedemotion]

Thanks for the nice video on vault, can you tell me how we can authenticate with value with an AWS Sso user ? With normal user when I pass access key and secrets it works but with SSO it is not Have to tried authenticating with vault using aws sso ?

[@TeKanAid]

Sorry for the late reply. I haven't seen this. There is an old discussion here, but seems to not be resolved discuss.hashicorp.com/t/vault-integration-with-aws-sso-saml-2-0/5461

[@jmfda00]

So good! TYVM!

[@TeKanAid]

You're welcome!

[@josephbatish9476]

amazing helpfully video !

[@TeKanAid]

Glad it was helpful!

[@maitheenfarmannulla8178]

I have a doubt, could you please tell me why we need to create a group in the Hashicorp vault in three lines...

[@TeKanAid]

Hi Maitheen, we use groups to group entities. I go into much more details with examples in my course: courses.tekanaid.com/p/hashicorp-vault-101-certified-vault-associate You can also read this tutorial from HashiCorp: learn.hashicorp.com/tutorials/vault/identity

[@munawarabbas1636]

Thanks Good effort

[@TeKanAid]

Thank you!

[@ashokd4673]

Suggest me how to import 100s of user name's and password's

[@TeKanAid]

best way is to either use the Terraform provider for Vault or use the Vault API

[@nrmz5728]

This is good stuff. Thank you

[@TeKanAid]

Glad it was helpful!

[@stevebuonincontri6853]

good tutorial

[@TeKanAid]

Thank you!

[@pabloqp7929]

Yay!!!!

[@TeKanAid]

Glad you enjoyed it!

[@mohmmad5343]

this man meme (live action version)

[@enabulelemartins7313]

I'm getting the below error, when I tried to enable log path ~$ vault audit enable file file_path=./logs/vault_audit.log Error enabling audit device: Error making API request. URL: PUT localhost:8200/v1/sys/audit/file Code: 400. Errors: * sanity check failed; unable to open "./logs/vault_audit.log" for writing: open ./logs/vault_audit.log: permission denied

[@TeKanAid]

This error message is indicating that the Vault server is unable to write to the specified log file path "./logs/vault_audit.log" due to a permission denied error. This could be caused by a few things: The directory "./logs" does not exist and needs to be created. The user running the command does not have permission to write to the specified directory. The permissions on the directory are not set correctly and need to be changed. You can check the directory is present or not using ls -ld ./logs and check the permissions of the directory using ls -ld /path/to/logs . You may need to adjust the permissions on the directory to allow the user running the command to write to it or you can run the command with root or sudo.