Watch ETCD change as Vault’s backend Install Vault & Etcd locally brew install etcd vault ➜ ~ etcd --version etcd Version: 3.4.15 Git SHA: Not provided (use ./build instead of go build) Go Version: go1.

RBAC 1. RBAC RBAC model: WHO DO WHAT Subject Verbs Resources In order to fully grasp the idea of RBAC, we must understand that three elements are involved: Subjects: The set of users and processes that want to access the Kubernetes API.

Prerequisites There are several decisions need to be made before deployment: 1. what should the container orchestration for Vault? Even I am a big fan of K8S, but GCP container on VM still can an option if you just need to deploy on container.

1.How aws EC2 generate instance identity documents? 2.How to leavage the instance identity for SSH? 3.How to limit ssh access via group policy? how ssh-agent works? 4.Except spire identity, what are the solutions for node attestation?

1. How spire do the node attestation for k8s node? 2.How could spire use slector for pod? mutating webhook or spire agent mount? 3.spire cert will be only used as mtls cert?