Secrets Provider and Secretless are two solutions that can minimize the Kubernetes application code changes required to adopt Conjur for secrets access. Secrets Provider is a Kubernetes Job or Deployment that runs as an init container or application container alongside the application pod. It retrieves secrets from Conjur and writes them to one or more files in a shared, mounted volume. The application can then consume the secrets from the files without any code changes, as reading local files is a common and platform-agnostic method. Secretless is a sidecar proxy that runs as a separate container in the same pod as the application. It intercepts the application’s requests to protected resources, such as databases or web services, and injects the secrets from Conjur into the requests. The application does not need to handle any secrets in its code, as Secretless handles the authentication and authorization for it.  References:   CyberArk Secrets Provider for Kubernetes ,  Secretless Broker

The correct sequence of steps to configure the Conjur Cluster with 3rd-party certificates is as follows:

Import 3rd-party certificates to the Leader using the command:  docker exec mycontainer evoke ca import --force --root < path-to-root-certificate > --chain < path-to-chain-certificate > 1

Configure the Leader using the command:  docker exec mycontainer evoke configure master --accept-eula --hostname < load-balancer-dns > --admin-password < password > < account-name > 1

Verify the Conjur Leader configuration using the command:  docker exec mycontainer evoke role 1

Configure the Standbys using the command:  docker exec mycontainer evoke configure standby --master-address < leader-ip-address > --master-fingerprint < leader-fingerprint > 1

References:  1 :  Certificate requirements

According to the CyberArk Sentry Secrets Manager documentation, Conjur is a secrets management solution that consists of a leader node and one or more follower nodes. The leader node is responsible for managing the secrets, policies, and audit records, while the follower nodes are read-only replicas that can serve secrets requests from applications. Additionally, Conjur supports a standby node, which is a special type of follower node that can be promoted to a leader node in case of a leader failure. A standby node is synchronized with the leader node and can take over its role in a disaster recovery scenario. A possible Conjur node role change is when a standby node is promoted to a leader node, either manually or automatically, using the auto-failover feature. A follower node cannot be promoted to a leader node, as it does not have the same data and functionality as the leader node. A standby node cannot be promoted to a follower node, as it already has the same capabilities as a follower node, plus the ability to become a leader node.  A leader node cannot be demoted to a standby node in the event of a failover, as it would lose its data and functionality and would not be able to resume its role as a leader node.  References :  1 :  Conjur Architecture   2 :  Deploying Conjur on AWS   3 :  Auto-failover

 The correct order of the steps is:

Define the Application with the desired authentication details

Add the Application ID and Application Provider ID to the safe with appropriate permissions

Configure application to call the appropriate REST API to retrieve the secret and test

Explanation : To allow an application to retrieve a secret with the CCP, the following steps are required:

Define the Application with the desired authentication details: This step involves creating an Application object in the Vault with a unique Application ID and an Application Provider ID. The Application Provider ID is used to identify the CCP instance that will serve the request. The Application object also defines the authentication method and parameters that the application will use to connect to the CCP, such as certificate, password, or AppRole.

Add the Application ID and Application Provider ID to the safe with appropriate permissions: This step involves granting the Application object the necessary permissions to access the safe and the secret that it needs. The Application ID and the Application Provider ID are added as members of the safe with at least List and Retrieve permissions. The secret name or ID can also be specified as a restriction to limit the access to a specific secret within the safe.

Configure application to call the appropriate REST API to retrieve the secret and test: This step involves configuring the application to send a REST API request to the CCP endpoint with the required parameters, such as the Application ID, the Application Provider ID, the safe name, and the secret name or ID. The application should also provide the authentication credentials or token that match the method defined in the Application object. The application should receive a JSON response from the CCP with the secret value and other metadata. The application should test the connection and the secret retrieval before deploying to production.

References :

CyberArk Secrets Manager

Sentry - Secrets Manager - Sample Items & Study Guide

Sentry - Secrets

Secrets Management Essentials for Developers

Followers are read-only replicas of the Leader that perform asynchronous replication from the Leader. This means that they receive updates from the Leader periodically, but not in real time. Followers are designed to handle all types of read requests from workloads and applications, such as authentication, permission checks, and secret fetches. Followers can scale horizontally to support a large number of concurrent requests and reduce the load on the Leader. Followers also provide high availability and disaster recovery by serving as backup nodes in case of Leader failure or network partition.  References:   Set up Follower ,  Deploy the Conjur Follower ,  Follower architecture

The appropriate Secrets Manager solution for each scenario is as follows:

token based retrieval of secrets, such as OIDC or JWT:  Conjur

workloads requiring the fastest secrets delivery performance possible:  ASCP

agentless workload authentication that relies on OS User:  CCP

These solutions are described in the  Secrets Management Tools  page of the CyberArk website

According to the CyberArk Sentry Secrets Manager documentation, auto-failover is a feature that enables the automatic promotion of a standby node to a leader node in case of a leader failure. Auto-failover requires a quorum, which is a majority of nodes in the cluster that are available and synchronized. A quorum ensures that only one node can be promoted to a leader at a time and prevents split-brain scenarios. In the exhibit, each option shows a network diagram of a load balancer and four nodes, one of which is crossed out with a red X, indicating a leader failure. The text below each diagram indicates whether there is a quorum or not. Option C is the only example where auto-failover will occur, because there is a quorum of three out of four nodes, and one of the standby nodes can be promoted to a leader. Option A will not have auto-failover, because there is no quorum, as only two out of four nodes are available. Option B will not have auto-failover, because there is no quorum, as only one out of four nodes is available.  Option D will not have auto-failover, because there is no quorum, as none of the nodes are available.  References :  1 :  Auto-failover   2 :  Configure auto-failover

 The error message “psql: server closed the connection unexpectedly” means that the server terminated abnormally before or while processing the request. This is likely due to the Leader Load Balancer not being available on the port and replication cannot be established. The port that is the problem is 5432, which is the default port for PostgreSQL database connections. The Follower needs to connect to the Leader Load Balancer on this port to receive the replication data from the Leader. If the port is blocked or unreachable, the Follower will fail to sync with the Leader and display the error message.  References:  [Set up Follower], [Troubleshoot Follower]