Unlocking possibilities

Plugging in to think outside the box

Vodafone invested in Vault Enterprise for its combination of out-of-the-box features and its extensibility to support future projects. Already, Andy’s team used Vault for secrets management and multiple data-analytics streams. Vault Enterprise offered these capabilities, as well as extensive governance and policy features, meaning Vodafone could write policies to manage which team members had which privileges, like encrypting and decrypting data. Vault Enterprise also offered remediation as part of its “rock-solid” backup and recovery solution.

The team also needed something to support its data encryption at scale with the Google Tink engine. While the task at hand wasn’t the purview of an out-of-the-box Vault feature, Vodafone was enamored with the sheer potential of the platform. “We began experimenting with Vault, wondering what was possible. We needed something to pseudonymize data at scale, handle all sorts of keys, and go really fast while doing so.”

The team decided to explore the potential of Vault by writing its own plugin. When they were done, the major functionality of the plugin included:

• A custom secrets engine plugin to Vault that enables data to be encrypted and decrypted with Google Tink keysets for anonymization purposes.
• Server-side anonymization, key lifecycle management, and synchronization with Big Query.
• Transient or stateless data encryption and decryption, with the configuration and keys held securely in Vault.

"As server-side encryption is a compute heavy task", says Lee, "we decided to utilize the scalability of Kubernetes to keep pace with the demands of changing workloads". To separate compute from storage, Lee provisioned two clusters, one to run Consul for HA storage and an Autopilot cluster for Vault with the Tink plugin preinstalled into the Vault container image for speed. The clusters communicated via a high performance internal load balancer. This separation allowed Vault to scale rapidly, without impacting the backend storage unnecessarily.

Vault extensibility unlocks new possibilities

The Vodafone team got itself up and running, and HashiCorp architects and solutions engineers worked with Vodafone to polish the plugin. HashiCorp’s team helped Vodafone fine tune settings and reviewed the architecture and scaling approach to ensure the solution would work seamlessly.

The plugin Vodafone wrote enables an operational change. Rather than Vault dispensing keys to clients, the change allowed Vault to encrypt data and send it back to the client without giving out the keys. “We already had experience with Vault and knew how to use it,” says Andy. “It was more a question of what else can we do with Vault? We were using it as a secrets manager. Now we’re also using it as an encryption engine.”

In fact, Vault has become even more than an encryption engine. For Vodafone, Vault is a full execution framework with built-in security. Because Vodafone could write its own plugin, it could also write its own endpoints for the plugin’s functionality. Instead of fulfilling a specific need, Vault became an all-encompassing enabler, showing Vodafone what kinds of things were possible.

Andy says he’s impressed with what has been possible with Vault. “Look what you can do if you’re a Vault Enterprise customer. Look how easy it is to write a plugin to your own requirements, and make it process as fast as you can afford.”