# HashiCorp Vault HashiCorp Vault is an identity-based secrets and encryption management system that centralizes secret management, controls access through authentication and authorization, and audits client interactions. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## 🔐 AccessOrbit: One-Click, Time-Limited DB Access with Hashicorp Vault & GitHub Actions DevFeed: [🔐 AccessOrbit: One-Click, Time-Limited DB Access with Hashicorp Vault & GitHub Actions]() Original publisher: [Read original article]() Author: Pavlos Petros Tournaris Published: 2025-05-06T09:36:40Z Content type: tutorial Language: en Sources: [Blueground Engineering blog]() Topics: [HashiCorp Vault](), [GitHub Actions](), [Databases](), [Security](), [Access Control](), [Slack]() Tags: [access-control](), [databases](), [dynamic-secrets](), [github-actions](), [hashicorp-vault](), [least-privilege](), [notifications](), [secrets](), [security]() ### AI overview Blueground describes AccessOrbit, a self-service workflow for requesting temporary database credentials. It combines HashiCorp Vault, GitHub Actions, GitHub Issues, and Slack to support auditable requests, approvals, and time-limited access. ### Source excerpt At some point, most platform teams face a common challenge: how to provide engineers with timely, auditable, and secure access to production (or staging) databases--without blowing a hole in security or flooding Slack with manual approval chaos. At Blueground, we've implemented a fully automated, self-serve ## Secure your terraform.state file with Terraform Vault Backend DevFeed: [Secure your terraform.state file with Terraform Vault Backend]() Original publisher: [Read original article]() Author: Zalan Blenessy Published: 2024-10-29T08:45:07Z Content type: tutorial Language: en Sources: [Volvo Cars Engineering - Medium]() Topics: [Terraform](), [HashiCorp Vault](), [Amazon S3](), [DevOps](), [HTTP](), [CI/CD]() Tags: [automotive-industry](), [aws-s3](), [backend-development](), [ci-cd](), [devops](), [hashicorp-vault](), [http](), [s3](), [security](), [software-development](), [terraform](), [vault]() ### AI overview This article introduces the Terraform Vault Backend, a specialized Terraform HTTP backend for storing terraform.state files in HashiCorp Vault. It explains why shared remote state is needed, how Terraform state works, and why state files containing secrets may require more secure storage than ordinary blob stores such as AWS S3. ### Source excerpt tl;dr: The Terraform Vault Backend is the missing complement to the Terraform Vault Provider. Volvo Cars has since 2017 strategically grown its software engineering organisation. Today, we have thousands of software engineers and hundreds of DevOps engineers to facilitate efficient tooling and workflows for software development and release. In my role as a CI Architect at the Complete Software Factory (CSwF) department, I am accountable for the CI/CD systems at CSwF. Most of our services are hosted in "the Cloud" and terraform is the most popular tool used by our DevOps engineers to provision Cloud infrastructure. This article introduces the Terraform Vault Backend, a specialised Terraform HTTP Backend which allows you to store your terraform.state file in HashiCorp Vault. This is relevant if your terraform.state contains secrets, too sensitive to be stored in ordinary blob stores like AWS S3. Terraform is a tool that generates infrastructure from code. Given some configuration, running terraform apply makes Terraform intelligently carry out the actions needed to create the desired infrastructure. For example, you can put the following configuration in main.tf: resource "local_file" "somefile" { content = "foo bar baz" filename = "${path.module}/somefile.txt" } Then apply it with: $ terraform init $ terraform apply Out comes a file called somefile.txt with the content foo bar baz. You can inspect it with: $ cat somefile.txt foo bar baz It also creates a bunch of other files in your folder, most notably the terraform.state file. This file reflects the current state of the "infrastructure" (somefile.txt), which has been provisioned for you. Terraform is idempotent, which means that running terraform apply a second time, with the same input configuration, will not change anything as somefile.txt has already been added to terraform.state . Sharing Terraform State It is not enough to share your Terraform configuration files with your colleagues, you also need to share th ## Cutting over-provisioning with KEDA: cron, external triggers, and a Selenium Grid queue DevFeed: [Cutting over-provisioning with KEDA: cron, external triggers, and a Selenium Grid queue]() Original publisher: [Read original article]() Published: 2024-09-04T00:00:00Z Content type: article Language: en Sources: [Andika Ahmad Ramadhan -- Blog]() Topics: [autoscaling](), [Kubernetes](), [Selenium](), [Testing](), [HashiCorp Vault](), [migration](), [Prometheus]() Tags: [autoscaling](), [cost](), [hashicorp-vault](), [kubernetes](), [migration](), [prometheus](), [selenium](), [testing]() ### AI overview An experience report on using KEDA cron and external scalers to reduce idle Kubernetes capacity. It describes scaling workloads by schedules, queue depth, and Prometheus queries, including a Selenium Grid whose browser nodes scale with queued test sessions. The article also discusses migration from VMs to Kubernetes and a Vault-related operator bug discovered in production. ### Source excerpt How I used KEDA cron scalers, external triggers, and Selenium Grid queue scalers to stop paying for idle replicas in production. ## 10 Reasons You Need Teleport to Secure Your Apps on AWS DevFeed: [10 Reasons You Need Teleport to Secure Your Apps on AWS]() Original publisher: [Read original article]() Author: info@goteleport.com (Steven Martin) Published: 2021-11-29T00:00:00Z Content type: opinion Language: en Sources: [Teleport]() Topics: [Amazon Web Services](), [Security](), [AWS Management Console](), [Command-line interface](), [Provisioning](), [Amazon EC2](), [Amazon Elastic Kubernetes Service](), [Kubernetes](), [DevOps](), [GitLab](), [Jenkins](), [HashiCorp Vault]() Tags: [aws](), [aws-management-console](), [cli](), [devops](), [ec2](), [gitlab](), [hashicorp-vault](), [jenkins](), [kubernetes](), [provisioning](), [security](), [zero-trust-networking]() ### AI overview A promotional article presents ten reasons to use Teleport for securing applications and infrastructure access on AWS. The supplied sections describe identity-aware, role-based access controls for the AWS Management Console and CLI, temporary elevated access, access controls for EC2, databases, EKS clusters, and DevOps tools, plus zero-trust networking. ### Source excerpt Just in time for re:Invent 2021, here is the list of top 10 things you should know about AWS and Teleport. ## Apache Airflow 1.10.12 DevFeed: [Apache Airflow 1.10.12]() Original publisher: [Read original article]() Author: Apache Airflow Published: 2020-08-25T00:00:00Z Content type: release Language: en Sources: [Apache Airflow Blog]() Topics: [airflow](), [sensitive data](), [Amazon S3](), [HashiCorp Vault](), [Kubernetes]() Tags: [airflow](), [apache](), [apache-airflow](), [bug-fixes](), [changelog](), [class](), [improvements](), [kubernetes](), [new-features](), [pypi](), [release](), [s3](), [secrets](), [sensitive-data](), [upgrade](), [vault]() ### AI overview Apache Airflow 1.10.12 is a release containing 113 commits since 1.10.11, including new features, improvements, bug fixes, and documentation changes. It adds custom XCom classes, secret-backed configuration for sensitive values, and AirflowClusterPolicyViolation support in local settings. The article recommends upgrading directly to 1.10.12 because Airflow 1.10.11 introduced breaking changes related to KubernetesExecutor and KubernetesPodOperator. ### Source excerpt Airflow 1.10.12 contains 113 commits since 1.10.11 and includes 5 new features, 23 improvements, 23 bug fixes, and several doc changes. Details: PyPI: https://pypi.org/project/apache-airflow/1.10.12/ Docs: https://airflow.apache.org/docs/1.10.12/ Changelog: http://airflow.apache.org/docs/1.10.12/changelog.html Airflow 1.10.11 has breaking changes with respect to KubernetesExecutor & KubernetesPodOperator so I recommend users to directly upgrade to Airflow 1.10.12 instead. Some of the noteworthy new features (user-facing) are: Allow defining custom XCom class Get Airflow configs with sensitive data from Secret Backends Add AirflowClusterPolicyViolation support to Airflow local settings Allow defining Custom XCom class Until Airflow 1.10.11, the XCom data was only stored in Airflow Metadatabase. From Airflow 1.10.12, users would be able to define custom XCom classes. This will allow users to transfer larger data between tasks. An example here would be to store XCom in S3 or GCS Bucket if the size of data that needs to be stored is larger than XCom.MAX_XCOM_SIZE (48 KB). PR: https://github.com/apache/airflow/pull/8560 Get Airflow configs with sensitive data from Secret Backends Users would be able to get the following Airflow configs from Secrets Backend like Hashicorp Vault: sql_alchemy_conn in [core] section fernet_key in [core] section broker_url in [celery] section flower_basic_auth in [celery] section result_backend in [celery] section password in [atlas] section smtp_password in [smtp] section bind_password in [ldap] section git_password in [kubernetes] section Further improving Airflow's Secret Management story, from Airflow 1.10.12, users don't need to hardcode the sensitive config value in airflow.cfg nor then need to use an Environment variable to set this config. For example, the metadata database connection string can either be set in airflow.cfg like this: [core] sql_alchemy_conn_secret = sql_alchemy_conn This will retrieve config option from the set Secre ## Apache Airflow 1.10.10 DevFeed: [Apache Airflow 1.10.10]() Original publisher: [Read original article]() Author: Apache Airflow Published: 2020-04-09T00:00:00Z Content type: release Language: en Sources: [Apache Airflow Blog]() Topics: [airflow](), [Docker](), [Python](), [changelog](), [HashiCorp Vault](), [ui]() Tags: [3](), [airflow](), [apache-airflow](), [bug-fixes](), [changelog](), [docker](), [docker-image](), [dockerhub](), [environment-variables](), [hashicorp-vault](), [new-features](), [python](), [release](), [timezone](), [ui]() ### AI overview Apache Airflow 1.10.10 includes 199 commits since version 1.10.9, with 11 new features, 43 improvements, 44 bug fixes, and documentation changes. Notable additions include selectable RBAC UI timezones, production Docker images, secrets backends, DAG serialization for stateless webservers, and other UI and task-execution changes. ### Source excerpt Airflow 1.10.10 contains 199 commits since 1.10.9 and includes 11 new features, 43 improvements, 44 bug fixes, and several doc changes. Details: PyPI: https://pypi.org/project/apache-airflow/1.10.10/ Docs: https://airflow.apache.org/docs/1.10.10/ Changelog: http://airflow.apache.org/docs/1.10.10/changelog.html Some of the noteworthy new features (user-facing) are: Allow user to choose timezone to use in the RBAC UI Add Production Docker image support Allow Retrieving Airflow Connections & Variables from various Secrets backend Stateless Webserver using DAG Serialization Tasks with Dummy Operators are no longer sent to executor Allow passing DagRun conf when triggering dags via UI Allow user to choose timezone to use in the RBAC UI By default the Web UI will show times in UTC. It is possible to change the timezone shown by using the menu in the top right (click on the clock to activate it): Screenshot: Details: https://airflow.apache.org/docs/1.10.10/timezone.html#web-ui Note: This feature is only available for the RBAC UI (enabled using rbac=True in [webserver] section in your airflow.cfg). Add Production Docker image support There are brand-new production images (alpha quality) available for Airflow 1.10.10. You can pull them from the Apache Airflow Dockerhub repository and start using it. More information about using production images can be found in https://github.com/apache/airflow/blob/master/IMAGES.rst#using-the-images. Soon it will be updated with information how to use images using official helm chart. To pull the images you can run one of the following commands: docker pull apache/airflow:1.10.10-python2.7 docker pull apache/airflow:1.10.10-python3.5 docker pull apache/airflow:1.10.10-python3.6 docker pull apache/airflow:1.10.10-python3.7 docker pull apache/airflow:1.10.10 (uses Python 3.6) Allow Retrieving Airflow Connections & Variables from various Secrets backend From Airflow 1.10.10, users would be able to get Airflow Variables from Environment Variabl