2018-03-09

1. Copyright © 2018 HashiCorp
Delivering Secret
Zero: Vault AppRole
with Terraform and
Chef
Presented By:
Teddy Sacilowski
Sr. Solutions Engineer

2. Copyright © 2018 HashiCorp
▪ Teddy Sacilowski
▪ Sr. Solutions Engineer @ HashiCorp
▪ Email: teddy@hashicorp.com
▪ Demo repo: https://github.com/hashicorp/vault-
guides/tree/master/identity/vault-chef-approle
About Me
2

3. Copyright © 2018 HashiCorp
▪ Allow myself to introduce… myself…
▪ Lots of conceptual material, looking at source code…
▪ Actual demo part is short
▪ Close the loop with Seth Vargo's Chef + Vault blog/webinar
▪ Understand Vault authentication, in general
▪ Understand Secure Introduction (SI), in general
▪ Learn the AppRole pattern and how it helps with SI
Agenda
3

4. Copyright © 2018 HashiCorp
▪ Using HashiCorp's Vault with Chef:
https://www.hashicorp.com/blog/using-hashicorps-vault-with-chef
▪ Manage Secrets with Chef and HashiCorps Vault - Chef Blog:
https://blog.chef.io/2016/12/12/manage-secrets-with-chef-and-
hashicorps-vault/
▪ Really awesome job defining Chef + HashiCorp Vault integration
patterns
▪ Missing Pieces... how do I get Chef or [insert any other app, client, server, etc.]
to authenticate with Vault programmatically???
Closing the Loop...
4

5. Copyright © 2018 HashiCorp
▪ Vault == centralized secrets management
▪ All our "things" are dynamic, distributed (or at least we want them to be...)
▪ Let’s not depend on humans to deliver secrets
▪ To get to our secrets, we need to authenticate
▪ Maps down to the issuance of a token (LDAP/AD; AWS Auth; Google Cloud Auth;
Whatever Auth...)
▪ Policies are attached to the tokens (for the most part...)
▪ All subsequent requests/operations require this token, so…
▪ How do we securely deliver auth tokens to our programmatic clients??
▪ ^^ This is our challenge, and we use Secure Intro to solve it...
Context: Authentication in Vault
5

6. Copyright © 2018 HashiCorp
▪ See Jeff Mitchell's talk Managing Secrets in a Container Environment - YouTube:
https://www.youtube.com/watch?v=skENC9aXgco
▪ Step 1, see if native auth capabilities are enough
▪ AWS Auth
▪ Google Cloud Auth
▪ Kubernetes Auth
▪ See Brokering Cloud Identity: https://www.hashicorp.com/blog/brokering-cloud-identity
▪ Circle of trust... we already have solutions in place that we trust to do "things"
▪ K8s for container scheduling/orchestration... or... Nomad (or even... both??) ;-)
▪ Terraform for provisioning
▪ Chef, Ansible, Puppet, [insert preferred CM tool here] for config management
▪ Jenkins, CircleCI, Travis, [insert preferred CI/CD tool here] (and maybe Packer??)
More Context: Secure Introduction
6

7. Copyright © 2018 HashiCorp
▪ But really, how much do I (or should I) trust any one system?
▪ Say I store a Vault token on my Chef Server to retrieve DB credentials for
MyWebScaleApp?
▪ Do I want a Chef Admin to potentially be able to retrieve those DB creds?
▪ Doesn't sound like least privilege to me…
▪ Most likely, at least two of these systems are involved in getting our apps
running
▪ What if we had a way to distribute parts of an authentication through separate
channels??
▪ Hint: that's what AppRole allows us to do!
Even More Context: Secure Introduction…
7

8. Copyright © 2018 HashiCorp
▪ Think of AppRole as similar to username/password, but for machines
▪ RoleID - static identifier that… well… identifies our specific role
▪ Not considered secret/sensitive
▪ Can be embedded in an AMI, app code, Dockerfile, env var, etc.
▪ Can’t do anything with just the RoleID
▪ SecretID - this value is considered sensitive and should be unique to each client
▪ Might be delivered via config mgmt, orchestrator, etc.
▪ Also, can’t do anything with just the SecretID
▪ But when I bring them together => Vault token!
▪ … And now my server/app/container can do [permitted] "stuff" in Vault
So… What’s AppRole?
8

9. Copyright © 2018 HashiCorp
AppRole Authentication
9
Trusted Systems
(Terraform, Jenkins, Chef,
Nomad, Kubernetes, Pivotal
Cloud Foundry, etc.)
Targets
(Servers, Applications,
Containers, etc.)
Get RoleID
Get SecretID
(wrapped)
Deliver RoleID
Deliver SecretID
(wrapped)
1. Unwrap SecretID
2. AppRole login with RoleID + SecretID
3. Get Authentication token back from Vault

10. Copyright © 2018 HashiCorp
AppRole Authentication
10
Trusted Systems
(Terraform, Jenkins, Chef,
Nomad, Kubernetes, Pivotal
Cloud Foundry, etc.)
Targets
(Servers, Applications,
Containers, etc.)
Get RoleID
Get SecretID
(wrapped)
Deliver RoleID
Deliver SecretID
(wrapped)
1. Unwrap SecretID
2. AppRole login with RoleID + SecretID
3. Get Authentication token back from Vault

11. s
Copyright © 2018 HashiCorp 11
Demo Time!

12. s
Copyright © 2018 HashiCorp 12
Questions?

13. Thank you.
hello@hashicorp.comwww.hashicorp.com