Regarding Credentials & Certificates

[jmg011]

1. Is there a way to integrate Vault credentials in Harvest.yml configuration file instead of using clear text username and password?
2. Regarding certificates as an alternative to username/password, is there a documentation on how to set it up for both cmode and 7mode?

[rahulguptajss]

@jmg011

1. Does https://github.com/NetApp/harvest/wiki/Harvest-and-Secrets-Management-with-SOPs help?
2. Certificates https://netapp.github.io/harvest/latest/prepare-cdot-clusters/#using-certificate-authentication

[jmg011]

@rahulguptajss @cgrinds Thank you. File encryption is a good idea and certificate is better. But 7modes won't support certificate as @cgrinds mentioned, so we do need to go with encryption. However, Is there any other way to connect with the Vault? Like harvest can query Vault API to get password/token?

[cgrinds]

hi @jmg011 there are many auth implementations especially across the managed environements that Harvest runs. Which one are you interested in?

7mode does not support client certificates so nothing Harvest can do there. The SOP link Rahul pasted above was created for a few customers using 7mode that didn't want their passwords in the clear.

[jmg011]

@cgrinds Thank you so much for discussing this with the team and providing the possible solution. I will go through it and come back in next couple of days.

[jmg011]

@cgrinds I took some time on this. I started a thread on this and will get back soon.

[jmg011]

@cgrinds - Will the template based authentication work for default credentials or will it work for only poller level authentication?

[cgrinds]

hi @jmg011 vault agent is quite flexible since it handles the tokens, renewals, certificates, etc. With regards to default credentials - if you mean, will it work with ONTAP credentials listed in the Defaultssection of the harvest.yml, the answer is yes. That's how I set it up locally. If you meant something else, can you say a bit more about what the needs are for default credentials?

[jmg011]

@cgrinds This is what I meant "will it work with ONTAP credentials listed in the Defaults section of the harvest.yml". Thank you for confirming. I think this approach will work for us.