armon

7 ms·

1.
by armon 7mo ago
Lock contention is a real issue for any multi-threaded system, and while a RW mutex is useful when you have a longer executing critical section, for something very short lived there is still a cache coordination cost. In many of the HashiCo
2.
by armon 6y ago
We use HCL broadly across the HashiCorp portfolio. It was popularized by Terraform, but also used in Vault, Consul, Nomad, and Packer. Important to note, that HCL is designed to be completely interoperable with JSON. In practice, we find th
3.
by armon 6y ago
We've continued to grow the Nomad team, and are working towards the big 1.0 release milestone later this month. The OSS usage continues to grow double digit every quarter and our commercial offering generates millions in revenue. Nomad
4.
by armon 6y ago
You would point the application at the local port. It operates very similarly to SSH port forwarding. No fancy magic to intercept all traffic.
5.
by armon 6y ago
We don't have a white paper on this yet, but we have a white board video that explains both how it works conceptually as well as at a more technical level of deployment architecture and data flow. https://www.youtube.com&#x2
6.
by armon 6y ago
That is correct! The local proxy has a listening socket and handles all the authentication, encapsulation, and forwarding transparently.
7.
by armon 6y ago
Disclosure: I'm one of the founders of HashiCorp. Glad you found Consul easy to get going with. We definitely focus on enabling K8S as a first class platform. There is documentation on setting up Consul and operating with Kubernetes he
8.
by armon 7y ago
HashiCorp ( https://www.hashicorp.com ) | SRE, Software Engineers, Engineering Managers | REMOTE | Full-time HashiCorp builds DevOps tools for modern applications. We build open source tools including Vagrant, Packer, Terraform, C
9.
by armon 7y ago
HashiCorp ( https://www.hashicorp.com ) | SRE, Software Engineers, Engineering Managers | REMOTE | Full-time HashiCorp builds DevOps tools for modern applications. We build open source tools including Vagrant, Packer, Terraform, C
10.
by armon 8y ago
I gave a talk at GoSF about Radix trees, and how they are used heavily in HashiCorp products (Terraform, Consul, Vault, Nomad, etc). The slides are available here for those interested: https://speakerdeck.com/armon/radi
11.
by armon 8y ago
Hey, I'm one of the co-founders of HashiCorp. To keep it brief, we are more committed to Nomad today than before. The team has doubled in the last year, and we plan to grow further next year as well. Our goal has always been to build a
12.
by armon 8y ago
That is exactly right. At the bottom of the blog post we touch on this, but if you are using consul-template to provide secrets via a configuration file, it can either restart or reload (signal) the application to pickup the changes. Altern
13.
by armon 8y ago
Hey peteski22, Exactly what you suggested would work! Having an AppRole that never expires would allow the trusted orchestrator to authenticate on each run, and then generate and inject ephemeral credentials.
14.
by armon 8y ago
Vault is free and open source. We do have an enterprise product, but all the dynamic secrets capabilities exist in the open source!
15.
by armon 8y ago
There are some good suggestions in the replies here, but I'd recommend looking at our secure introduction guide here: https://www.vaultproject.io/guides/identity/secure-intro.htm... Effectively, there are onl
16.
by armon 8y ago
When Vault connects to the endpoint system to create a dynamic user, it presents a set of credentials only known to it. You have to authorize Vault to create dynamic users, so a malicious actor would need to somehow obtain a similar level o
17.
by armon 8y ago
We work with many Fortune 2000 customers, and having 500K secrets is on the extreme side and most certainly puts you in an infrastructure where you have 50K-100K+ machines under management. In terms of the "compute cost", for an i
18.
by armon 8y ago
Kerberos was a major inspiration for us! The goal of Vault was to be a modern Kerberos, but invert the integration model. I think that is the Achilles heel of Kerberos, since it has a complex API and only works if the endpoint systems are t
19.
by armon 9y ago
I'm one of the co-founders of HashiCorp, and I wanted to just chime in on the release. We may have done a disservice in the blog post by highlighting the new features landing in the Enterprise versions, because it obscures all the new
20.
by armon 10y ago
I'm curious if the author was aware of our implementation at HashiCorp ( https://github.com/hashicorp/memberlist ). We use that implementation in Serf ( https://www.serf.io ) to provide membership, failure
21.
by armon 10y ago
The used synthetic benchmark is not a great indicator of performance in most (any?) production environments. It's generally useful and interesting to understand the tradeoffs between an LSM and B-Tree. Particularly, if you have an upda
22.
by armon 10y ago
I've given a talk at Papers We Love about Bloom Filters ( http://paperswelove.org/2015/video/armon-dadgar-on-bloom-fil... ) for those wanting to learn more. There have been quite a few follow on extensions to s
23.
Changing minds and reducing prejudice through conversation(nytimes.com)
3 points by armon 10y ago|0 comments
24.
by armon 11y ago
The article can probably be succinctly summarized as "Premature optimization is the root of all evil". Most of the authors points are valid, in that caching adds more complexity. That said, caching is absolutely critical to almost
25.
by armon 11y ago
To clarify, statsite does spawn threads to do some of the aggregation and flushing at the end of the collection interval, but yes it is possible to saturate the main loop at a very high ingest rate.
26.
by armon 11y ago
This looks pretty interesting! We use a library we've built called relay ( https://github.com/armon/relay ) to do something similar also in Go. I like the higher level task based approach of this library, since this
27.
Dark Launching using Consul(code.hootsuite.com)
2 points by armon 12y ago|0 comments
28.
by armon 12y ago
The issues discussed by aphyr have been fully fixed as of Consul 0.2, several months ago. In the initial release of Consul, only the "default" mode was available and has the now-documented caveat of a stale read possibility. The v
29.
by armon 12y ago
You are right, the communication is still unicast in nature. I should clarify to say that there isn't a persistent 1-to-1 communication, the nodes we gossip with are randomly selected on each interval. There is no connection or session
30.
by armon 12y ago
We compare Consul to SmartStack here: https://www.consul.io/intro/vs/smartstack.html With a tool like consul-template, you can have the same behavior that Synapse gives you. https://hashicorp.com/b

More ›