You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Vault needs to have network access to different components as secret engines. This might not be feasible when:
The target is in a private network and does not have a public IP address
The target is in a network where only outbound connections are allowedE
One doesn't want to expose the target on a public network
Describe the solution you'd like
While providing direct network access might not be secure and maintainable, if Vault could connect to targets through a proxy server, the proxy server could do the heavy-lifting of routing, access control, audit, etc. Implementing the socks5/http proxy for handling TCP connections could be generic enough, so that the user could bring their own implementation of proxies.
Describe alternatives you've considered
The proxying could be performed through a transparent proxy mechanism, but that is less than ideal since it's all or nothing and less configurable.
Explain any additional use-cases
The user might have an existing zero-trust network, and would like to leverage that for connecting to its endpoints. The zero-trust network might be Boundary Connect to endpoints thru Hashicorp Boundary #11459
Additional context
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
Vault needs to have network access to different components as secret engines. This might not be feasible when:
Describe the solution you'd like
While providing direct network access might not be secure and maintainable, if Vault could connect to targets through a proxy server, the proxy server could do the heavy-lifting of routing, access control, audit, etc. Implementing the socks5/http proxy for handling TCP connections could be generic enough, so that the user could bring their own implementation of proxies.
Describe alternatives you've considered
The proxying could be performed through a transparent proxy mechanism, but that is less than ideal since it's all or nothing and less configurable.
Explain any additional use-cases
Additional context
The text was updated successfully, but these errors were encountered: