Hashi Vault Primitives

Some Vault Primitives

Pretty much everywhere you go in vault you will find you need a few building blocks to make anything work.

Env Vars

Regardless of how you choose to talk to vault (CLI/WebAPI/SDK), you will find that the most common way to “encode” the vault settings is in an Environment variable. This is a nod towards its “cloud native” upbringing, where config files are the devil or something.

[Read more]

Bootstrapping Hashi Vault

note: this was updated in Sept-2026 with docker compose file changes for Vault 2.1. I considered re-writing to OpenBao, but i didnt fancy all the dangling references being weird.

Recently I have spent a reasonable amount of time in Hashicorp vault. As part of a mini series on how to make better use of it in Network Automation, I started writing this as a “intro” to a post on the subject.

[Read more]

My Updated Fiber7-X VyOS 1.5 Config

A while ago I wrote about my VyOS config for Init7’s Fiber7-X product. Since then there has been a number of breaking changes, and a few additions that I would like to cover.

I will copy/paste a lot of the narrative from that post, and avoid a bit of the abstract conversation that went with it, so that this stands on its own.

If you have questions or comments, hit me up.

[Read more]

Untangling My Brain From Autocon1

Last week I had some fun in Amsterdam, and at no point was there any debauchery.

For those who are unaware, Autocon is a conference put together by the Network Automation Forum. Autocon1 was the second event ever, and the first in Europe. They ran autocon0 in Denver in the Autumn of 2023.

TL:DR - if you are in the network automation space, you have to try and get yourself there. It’s a very valuable event.

[Read more]

Using VPP as a MACSEC Replacement

As part of my VPP Adventures series, we have talked about what VPP is, why its interesting, and how we can prove it works. Today we spend a bit of time on what we can actually do with it.

Who actually uses MACSEC these days?

My first interest for a real world test of VPP was straight BGP routing for DFZ connected services. Kinda obvious no? For long and complicated reasons, it actually wasn’t (more specifically it couldn’t - we use IS-IS as part of our edge routing environment and VPP has issues there). Blocked on that, we found ourselves looking at something more esoteric.

[Read more]