Keybase Vault Auto-Unseal
summary
Automates Vault init and unseal by storing Shamir shares encrypted to a Keybase team and retrieving them via each user’s PGP key; uses Ansible playbooks plus Vagrant and Packer to build a Consul-backed Vault cluster and a reusable demo image. Initializes with five key shares and a 3-of-5 threshold (uploader says 3/5), encrypts the init JSON with Ansible Vault, decodes each member’s base64 PGP blob and runs vault operator unseal; the repo demonstrates successful automated unsealing in the dev environment.
AI-written summary · about
chapters (9)
- 0:00Introduction to Vault
- 2:21Initialization and Unsealing
- 5:31Shamir's Secret Sharing
- 7:27Automating Security
- 11:27Integration tools overview
- 13:40Ansible and Keybase workflow
- 17:42Automated unsealing demo
- 21:22Cluster management and demo
- 24:55Conclusion and resources
related talks
35mOops, I committed my private key: Automating security from with IoT and IaC
41mHiding secrets in a Vault
29mAdopting HashiCorp Vault: Deployment, Adoption, and Beyond
51mIntroduction to Vault
43mSecret Management with Hashicorp's Vault
34mWhich Vault? Don't tell me your secret(s)!
44mSecret Management with Hashicorp's Vault
31mVault and Secret Management in Kubernetes