Multi-Account, Multi-Region, Multi-Runtime

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Slide 3

Slide 3 text

© 2023 HASHICORP dev 3 kubernetes admin partition default namespace service-1 namespace virtual-machine admin partition service-2 namespace default admin partition default namespace prod kubernetes admin partition default namespace service-1 namespace virtual-machine admin partition service-2 namespace default admin partition default namespace

Slide 4

Slide 4 text

Slide 5

Slide 5 text

© 2023 HASHICORP 5 us-east-1 kubernetes admin partition default namespace service-1 namespace virtual-machine admin partition service-2 namespace default admin partition us-west-2 kubernetes admin partition default namespace service-1 namespace virtual-machine admin partition service-2 namespace default admin partition cluster peering

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

© 2023 HASHICORP & the “Gotchas” ● Prior recommendation: WAN Federation ● Mesh gateway per admin partition ● Export services across partition ● Assign IP address per service instance ● Peer between non-prod / prod? 8 Technical Considerations

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

© 2023 HASHICORP 15 us-east-1 /boundary path /consul path /prod path /prod/service-1 path /prod/kubernetes path us-west-2 /boundary path /consul path /prod path /prod/service-1 path /prod/kubernetes path Terraform / Other Automation

Slide 16

Slide 16 text

© 2023 HASHICORP 16 us-east-1 /boundary namespace /consul namespace /prod namespace /prod/service-1 namespace /prod/kubernetes namespace us-west-2 /boundary namespace /consul namespace /prod namespace /prod/service-1 namespace /prod/kubernetes namespace replication developer.hashicorp.com/vault/docs/enterprise/replication

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Slide 20

Slide 20 text

© 2023 HASHICORP & the “Gotchas” ● Replicate configuration, policies, secrets engines ● Does not replicate leases or tokens ● To avoid replication… ○ Top-level paths filter (globally enforced) ○ Create secrets engine with -local option ● Nest namespaces vs. replicate across non-prod / prod ● Database replication versus database secrets engine 20 Technical Considerations

Slide 21

Slide 21 text

© 2023 HASHICORP 21 us-east-1 /database/customers us-west-2 /database/customers prod "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT ALL PRIVILEGES ON ${var.db_name} TO \"{{name}}\";"

Slide 22

Slide 22 text

© 2023 HASHICORP 22 us-east-1 /database/customers us-west-2 /database/customers prod "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT ALL PRIVILEGES ON ${var.db_name} TO \"{{name}}\";" Cross-region DNS / Load Balancer

Slide 23

Slide 23 text

© 2023 HASHICORP 23 us-east-1 /database/customers us-west-2 /database/customers prod "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT ALL PRIVILEGES ON ${var.db_name} TO \"{{name}}\";" prod read replica

Slide 24

Slide 24 text

© 2023 HASHICORP 24 us-east-1 /database/customers us-west-2 /database/customers prod "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT ALL PRIVILEGES ON ${var.db_name} TO \"{{name}}\";" prod write replica* *depends on database

Slide 25

Slide 25 text

© 2023 HASHICORP 25 us-east-1 /database/customers prod "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT ALL PRIVILEGES ON ${var.db_name} TO \"{{name}}\";" developer.hashicorp.com/vault/docs/agent-and-proxy/proxy/apiproxy vault proxy

Slide 26

Slide 26 text

Slide 27

Slide 27 text

© 2023 HASHICORP primary us-east-1 27 controllers primary Boundary database cross-region load balancer with failover config standby us-west-2 controllers standby Boundary database read replica (promote on failover) developer.hashicorp.com/boundary/docs/install-boundary/fault-tolerance

Slide 28

Slide 28 text

© 2023 HASHICORP global 28 customer organization dev, us-east-1 worker dev-us-east-1 project dev, us-west-2 worker dev-us-west-2 project prod, us-east-1 worker dev-us-east-1 project prod, us-west-2 worker prod-us-west-2 project payment organization dev, us-east-1 worker dev-us-east-1 project dev, us-west-2 worker dev-us-west-2 project prod, us-east-1 worker dev-us-east-1 project prod, us-west-2 worker prod-us-west-2 project

Slide 29

Slide 29 text

© 2023 HASHICORP & the “Gotchas” ● (Current) Access Boundary cluster in single region ● Use worker tags to identify region, runtime, etc. ● Separate regions into projects / organizations for control ● Separate non-prod / prod (clusters vs. scopes) 29 Technical Considerations

Slide 30

Slide 30 text

Slide 31

Slide 31 text