Turning on audit logging can take Vault down
Vault refuses any request it cannot audit, which is correct — and makes a single audit device into a cluster-wide outage the day the disk fills. Two of the wrong kind do not help either.
Platform engineering and infrastructure as code — mostly writing about the parts that fail quietly.
Turning on audit logging can take Vault down
Vault refuses any request it cannot audit, which is correct — and makes a single audit device into a cluster-wide outage the day the disk fills. Two of the wrong kind do not help either.
I had to delete a passing test to fix the bug
Three assertions that were holding defects in place — one guaranteeing a cluster could never start, one dropping every client packet, one I wrote myself against a mock that had flattened the values it compared.
A hash chain is not tamper evidence
Chaining an audit log stops whoever cannot recompute the digests. That is not the person you are worried about: anyone who can edit the log can rewrite the chain over it, and the result verifies perfectly. What actually breaks that, and the test that proves it was needed.
A threshold alert on a metric that stops being
reported never fires — it has no series to evaluate, so it is silent
in exactly the situation it was written for. Pairing every freshness
rule with absent(), and proving in a test that the
threshold really does stay quiet.
Three green timers and zero backups
A test double can only encode what you already believe. Three incidents from a HashiCorp Vault platform — a shim that agreed with the bug, one that disagreed with the environment, and a mock that never modelled the consumer at all.
vault-reference-platform — a reference implementation for running HashiCorp Vault: HA Raft, auto-unseal, dynamic secrets, PKI migration, tamper-evident audit.