# HashiCorp Vault Published articles for HashiCorp Vault. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Running OpenBao on Kubernetes with a CloudNativePG PostgreSQL backend DevFeed: [Running OpenBao on Kubernetes with a CloudNativePG PostgreSQL backend]() Original publisher: [Read original article]() Author: Gabriele Bartolini (EnterpriseDB) and CNCF Ambassador, Rob Kenefeck (ControlPlane) Published: 2026-09-16T11:30:00Z Content type: tutorial Language: en Sources: [Cloud Native Computing Foundation]() Topics: [CloudNativePG](), [Kubernetes](), [PostgreSQL](), [Open Source](), [vendor lock-in]() Tags: [blog](), [cloudnativepg](), [docker](), [hashicorp-vault](), [helm](), [infrastructure](), [kubernetes](), [linux-foundation](), [open-source](), [postgresql](), [secrets](), [vendor-lock-in]() ### AI overview A tutorial describes deploying OpenBao on Kubernetes with a three-instance CloudNativePG PostgreSQL cluster as its storage backend. It explains certificate-based authentication and a local Kind-based test environment. ### Source excerpt Managing infrastructure secrets on Kubernetes needs a backend that is self-healing and free of vendor lock-in, and that is exactly what OpenBao (the Linux Foundation's open-source fork of HashiCorp Vault) and CloudNativePG give you: an entirely... ## New in Symfony 8.2: KeyManagement Component DevFeed: [New in Symfony 8.2: KeyManagement Component]() Original publisher: [Read original article]() Author: Javier Eguiluz Published: 2026-09-15T07:11:00Z Content type: release Language: en Sources: [Symfony Blog]() Topics: [Symfony](), [Encryption](), [Amazon Web Services](), [Azure](), [Google]() Tags: [2026](), [api](), [article](), [aws](), [azure](), [backend](), [encryption](), [features](), [google](), [hashicorp-vault](), [kms](), [new-features](), [openssl](), [sdk](), [symfony]() ### AI overview Symfony 8.2 introduces an experimental KeyManagement component that provides one API for AWS KMS, Azure Key Vault, Google Cloud KMS, and HashiCorp Vault. It supports direct and envelope encryption, local development backends, provider bridges, console commands, debug-toolbar integration, and Doctrine support. ### Source excerpt This is the first article in a series showcasing the most important new features introduced by Symfony 8.2, which will be released at the end of November 2026. Contributed... ## Percona Operator for PostgreSQL 3.1.0: Transparent Data Encryption, Logical Replicas, and Persistent Logging DevFeed: [Percona Operator for PostgreSQL 3.1.0: Transparent Data Encryption, Logical Replicas, and Persistent Logging]() Original publisher: [Read original article]() Author: Slava Sarzhan Published: 2026-09-09T16:08:31Z Content type: release Language: en Sources: [Blog - Percona]() Topics: [PostgreSQL](), [Encryption](), [Logging](), [Kubernetes](), [Open Source]() Tags: [cloud](), [encryption](), [hashicorp-vault](), [kubernetes](), [logging](), [open-source](), [operator](), [percona](), [percona-operator-for-postgresql](), [postgresql](), [release](), [replication](), [security](), [slavasarzhan-pg]() ### AI overview Percona Operator for PostgreSQL 3.1.0 adds transparent data encryption with pg_tde, logical replicas for read-only workloads, and persistent logging across Pod restarts. The release also adds official RKE2 support and full ARM64 images. ### Source excerpt Percona Operator for PostgreSQL 3.1.0 takes on three things that decide whether a PostgreSQL platform passes review: is the data encrypted at rest, can it serve reads without straining the primary, and are the logs there when you need them. This release answers all three inside the custom resource, so none of them is a ... Continued The post Percona Operator for PostgreSQL 3.1.0: Transparent Data Encryption, Logical Replicas, and Persistent Logging appeared first on Percona. ## Managing Environment Variables and Secrets in DevOps DevFeed: [Managing Environment Variables and Secrets in DevOps]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-08-01T13:00:47Z Content type: tutorial Language: en Sources: [Kubernetes - KodeKloud Blog | DevOps, Cloud, Kubernetes, AI Tutorials & More]() Topics: [DevOps](), [configuration](), [GitGuardian](), [GitHub](), [Terraform](), [Kubernetes]() Tags: [ci-cd-secrets-management](), [cloud](), [collaboration](), [collaboration-tools](), [configuration](), [container](), [crash](), [devops](), [devsecops](), [dynamic-secrets](), [env-file-security](), [environment-variables](), [gitguardian](), [github](), [hardcoded-credentials](), [hashicorp-vault](), [jira](), [kubernetes](), [kubernetes-secrets](), [leak](), [managing-environment-variables-and-secrets](), [rotation](), [safety](), [sealed-secrets](), [secret-rotation](), [secret-scanning](), [secrets](), [secrets-management-best-practices](), [security](), [storage](), [terraform](), [vault]() ### AI overview A guide to managing environment variables and secrets in DevOps. It explains how secrets escape through repositories, processes, crash reports, containers, collaboration tools, Kubernetes Secrets, and Terraform state, and discusses storage, access controls, lifecycles, and rotation. ### Source excerpt Nearly 29 million secrets were pushed to public GitHub in a single year, and most teams still discover their own leaks by accident. Here is how environment variables actually escape, and what to use instead at each stage. ## 🔐 AccessOrbit: One-Click, Time-Limited DB Access with Hashicorp Vault & GitHub Actions DevFeed: [🔐 AccessOrbit: One-Click, Time-Limited DB Access with Hashicorp Vault & GitHub Actions]() Original publisher: [Read original article]() Author: Pavlos Petros Tournaris Published: 2025-05-06T09:36:40Z Content type: tutorial Language: en Sources: [Blueground Engineering blog]() Topics: [HashiCorp Vault](), [GitHub Actions](), [Databases](), [Security](), [Access Control](), [Slack]() Tags: [access-control](), [databases](), [dynamic-secrets](), [github-actions](), [hashicorp-vault](), [least-privilege](), [notifications](), [secrets](), [security]() ### AI overview Blueground describes AccessOrbit, a self-service workflow for requesting temporary database credentials. It combines HashiCorp Vault, GitHub Actions, GitHub Issues, and Slack to support auditable requests, approvals, and time-limited access. ### Source excerpt At some point, most platform teams face a common challenge: how to provide engineers with timely, auditable, and secure access to production (or staging) databases--without blowing a hole in security or flooding Slack with manual approval chaos. At Blueground, we've implemented a fully automated, self-serve ## Neon Joins GitHub's Secret Scanning Partner Program to Strengthen Database Security DevFeed: [Neon Joins GitHub's Secret Scanning Partner Program to Strengthen Database Security]() Original publisher: [Read original article]() Author: Busra Demir Published: 2025-04-02T14:24:49Z Content type: news Language: en Sources: [Blog -- Neon Docs]() Topics: [GitHub](), [Secret Scanning](), [Security](), [API keys](), [Database](), [npm]() Tags: [api](), [api-keys](), [aws](), [company](), [env-file-security](), [environment-variables](), [github](), [hashicorp-vault](), [secret-scanning](), [secrets](), [security](), [security-best-practices]() ### AI overview Neon announces its participation in GitHub's Secret Scanning Partner Program. GitHub detects exposed Neon database credentials and API keys in public repositories and npm packages, then Neon validates the credentials, alerts its security team through Slack, and notifies affected customers. The article also recommends environment variables, secret management tools, and regular credential rotation. ### Source excerpt We're excited to announce that Neon is now a GitHub Secret Scanning Partner, joining a group of leading enterprises and technology firms working to enhance security. This partnership helps protect Neon users by automatically detecting exposed Neon database credentials and API key... ## Secure your terraform.state file with Terraform Vault Backend DevFeed: [Secure your terraform.state file with Terraform Vault Backend]() Original publisher: [Read original article]() Author: Zalan Blenessy Published: 2024-10-29T08:45:07Z Content type: tutorial Language: en Sources: [Volvo Cars Engineering - Medium]() Topics: [Terraform](), [HashiCorp Vault](), [Amazon S3](), [DevOps](), [HTTP](), [CI/CD]() Tags: [automotive-industry](), [aws-s3](), [backend-development](), [ci-cd](), [devops](), [hashicorp-vault](), [http](), [s3](), [security](), [software-development](), [terraform](), [vault]() ### AI overview This article introduces the Terraform Vault Backend, a specialized Terraform HTTP backend for storing terraform.state files in HashiCorp Vault. It explains why shared remote state is needed, how Terraform state works, and why state files containing secrets may require more secure storage than ordinary blob stores such as AWS S3. ### Source excerpt tl;dr: The Terraform Vault Backend is the missing complement to the Terraform Vault Provider. Volvo Cars has since 2017 strategically grown its software engineering organisation. Today, we have thousands of software engineers and hundreds of DevOps engineers to facilitate efficient tooling and workflows for software development and release. In my role as a CI Architect at the Complete Software Factory (CSwF) department, I am accountable for the CI/CD systems at CSwF. Most of our services are hosted in "the Cloud" and terraform is the most popular tool used by our DevOps engineers to provision Cloud infrastructure. This article introduces the Terraform Vault Backend, a specialised Terraform HTTP Backend which allows you to store your terraform.state file in HashiCorp Vault. This is relevant if your terraform.state contains secrets, too sensitive to be stored in ordinary blob stores like AWS S3. Terraform is a tool that generates infrastructure from code. Given some configuration, running terraform apply makes Terraform intelligently carry out the actions needed to create the desired infrastructure. For example, you can put the following configuration in main.tf: resource "local_file" "somefile" { content = "foo bar baz" filename = "${path.module}/somefile.txt" } Then apply it with: $ terraform init $ terraform apply Out comes a file called somefile.txt with the content foo bar baz. You can inspect it with: $ cat somefile.txt foo bar baz It also creates a bunch of other files in your folder, most notably the terraform.state file. This file reflects the current state of the "infrastructure" (somefile.txt), which has been provisioned for you. Terraform is idempotent, which means that running terraform apply a second time, with the same input configuration, will not change anything as somefile.txt has already been added to terraform.state . Sharing Terraform State It is not enough to share your Terraform configuration files with your colleagues, you also need to share th ## Cutting over-provisioning with KEDA: cron, external triggers, and a Selenium Grid queue DevFeed: [Cutting over-provisioning with KEDA: cron, external triggers, and a Selenium Grid queue]() Original publisher: [Read original article]() Published: 2024-09-04T00:00:00Z Content type: article Language: en Sources: [Andika Ahmad Ramadhan -- Blog]() Topics: [autoscaling](), [Kubernetes](), [Selenium](), [Testing](), [HashiCorp Vault](), [migration](), [Prometheus]() Tags: [autoscaling](), [cost](), [hashicorp-vault](), [kubernetes](), [migration](), [prometheus](), [selenium](), [testing]() ### AI overview An experience report on using KEDA cron and external scalers to reduce idle Kubernetes capacity. It describes scaling workloads by schedules, queue depth, and Prometheus queries, including a Selenium Grid whose browser nodes scale with queued test sessions. The article also discusses migration from VMs to Kubernetes and a Vault-related operator bug discovered in production. ### Source excerpt How I used KEDA cron scalers, external triggers, and Selenium Grid queue scalers to stop paying for idle replicas in production. ## 10 Reasons You Need Teleport to Secure Your Apps on AWS DevFeed: [10 Reasons You Need Teleport to Secure Your Apps on AWS]() Original publisher: [Read original article]() Author: info@goteleport.com (Steven Martin) Published: 2021-11-29T00:00:00Z Content type: opinion Language: en Sources: [Teleport]() Topics: [Amazon Web Services](), [Security](), [AWS Management Console](), [Command-line interface](), [Provisioning](), [Amazon EC2](), [Amazon Elastic Kubernetes Service](), [Kubernetes](), [DevOps](), [GitLab](), [Jenkins](), [HashiCorp Vault]() Tags: [aws](), [aws-management-console](), [cli](), [devops](), [ec2](), [gitlab](), [hashicorp-vault](), [jenkins](), [kubernetes](), [provisioning](), [security](), [zero-trust-networking]() ### AI overview A promotional article presents ten reasons to use Teleport for securing applications and infrastructure access on AWS. The supplied sections describe identity-aware, role-based access controls for the AWS Management Console and CLI, temporary elevated access, access controls for EC2, databases, EKS clusters, and DevOps tools, plus zero-trust networking. ### Source excerpt Just in time for re:Invent 2021, here is the list of top 10 things you should know about AWS and Teleport. ## The Birth of the External Secrets Community DevFeed: [The Birth of the External Secrets Community]() Original publisher: [Read original article]() Author: Lucas Severo Alves Published: 2021-05-06T07:12:38Z Content type: article Language: en Sources: [Blog - Container Solutions]() Topics: [Kubernetes](), [Maintainers](), [JavaScript]() Tags: [azure](), [google-cloud](), [hashicorp-vault](), [ibm](), [javascript](), [kubernetes](), [kubernetes-secrets](), [open-source](), [secret-rotation](), [security]() ### AI overview This article describes the growth of projects that synchronize secrets from external providers into Kubernetes and the formation of a community around the External Secrets Operator. It highlights GoDaddy's kubernetes-external-secrets project, its provider integrations and active maintenance, while noting that it was developed in JavaScript. ### Source excerpt Managing secrets in Kubernetes can be a cumbersome job. In a multi-service multi-environment setup, you can end up with hundreds of secrets without even noticing. It is hard to keep track of everything and at the same time manage secret rotation, onboard new services, and onboard new people with correct access permissions. ## Apache Airflow 1.10.10 DevFeed: [Apache Airflow 1.10.10]() Original publisher: [Read original article]() Author: Apache Airflow Published: 2020-04-09T00:00:00Z Content type: release Language: en Sources: [Apache Airflow Blog]() Topics: [airflow](), [Docker](), [Python](), [changelog](), [HashiCorp Vault](), [ui]() Tags: [3](), [airflow](), [apache-airflow](), [bug-fixes](), [changelog](), [docker](), [docker-image](), [dockerhub](), [environment-variables](), [hashicorp-vault](), [new-features](), [python](), [release](), [timezone](), [ui]() ### AI overview Apache Airflow 1.10.10 includes 199 commits since version 1.10.9, with 11 new features, 43 improvements, 44 bug fixes, and documentation changes. Notable additions include selectable RBAC UI timezones, production Docker images, secrets backends, DAG serialization for stateless webservers, and other UI and task-execution changes. ### Source excerpt Airflow 1.10.10 contains 199 commits since 1.10.9 and includes 11 new features, 43 improvements, 44 bug fixes, and several doc changes. Details: PyPI: https://pypi.org/project/apache-airflow/1.10.10/ Docs: https://airflow.apache.org/docs/1.10.10/ Changelog: http://airflow.apache.org/docs/1.10.10/changelog.html Some of the noteworthy new features (user-facing) are: Allow user to choose timezone to use in the RBAC UI Add Production Docker image support Allow Retrieving Airflow Connections & Variables from various Secrets backend Stateless Webserver using DAG Serialization Tasks with Dummy Operators are no longer sent to executor Allow passing DagRun conf when triggering dags via UI Allow user to choose timezone to use in the RBAC UI By default the Web UI will show times in UTC. It is possible to change the timezone shown by using the menu in the top right (click on the clock to activate it): Screenshot: Details: https://airflow.apache.org/docs/1.10.10/timezone.html#web-ui Note: This feature is only available for the RBAC UI (enabled using rbac=True in [webserver] section in your airflow.cfg). Add Production Docker image support There are brand-new production images (alpha quality) available for Airflow 1.10.10. You can pull them from the Apache Airflow Dockerhub repository and start using it. More information about using production images can be found in https://github.com/apache/airflow/blob/master/IMAGES.rst#using-the-images. Soon it will be updated with information how to use images using official helm chart. To pull the images you can run one of the following commands: docker pull apache/airflow:1.10.10-python2.7 docker pull apache/airflow:1.10.10-python3.5 docker pull apache/airflow:1.10.10-python3.6 docker pull apache/airflow:1.10.10-python3.7 docker pull apache/airflow:1.10.10 (uses Python 3.6) Allow Retrieving Airflow Connections & Variables from various Secrets backend From Airflow 1.10.10, users would be able to get Airflow Variables from Environment Variabl