Turtles All the Way Down: Storing Secrets in the Cloud and the Data Center
summary
Argues that storing secrets needs concrete choices not buzzwords and that the bootstrapping problem is unsolved but can be isolated into stages he calls turtles. Surveys specific tools (git-crypt, Blackbox, transcrypt, Hiera YAML, Chef encrypted data bags, Chef Vault, Ansible), evaluates secret services like Vault (powerful but high adoption cost) and Keywhiz (promising but brittle), and builds a dummy app deployed via Chef/Vagrant to test deployability and developer ergonomics — many tools work but operational tradeoffs remain.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:40INTRODUCTION
- 3:44WHAT'S THE PROBLEM?
- 5:30WHAT GOOD LOOKS LIKE
- 7:12WHAT DOES GOOD LOOK LIKE
- 9:52THE FIRST TURTLE
- 11:23STRATEGIES
- 12:06ORCHESTRATOR DECRYPTION
- 14:31APPLICATION DECRYPTION
- 16:00OPERATIONAL COMPARTMENTALIZATION
- 16:29ORGANIZATIONAL COMPARTMENTALIZATION
- 20:44SCM ENCRYPTION TOOLS
- 23:44ORCHESTRATION ENCRYPTION TOOLS
- 25:12THE SECOND TURTLE
- 26:22SECRETS SERVICES
- 29:08SECRETS AS A SERVICE
- 34:31THE THIRD TURTLE
- 37:14THE BIG PICTURE
- 39:04IN CLOSING
related talks
35mTurtles All the Way Down: Managing Kubernetes Secrets
29mBehind Closed Doors: Managing Passwords in a Dangerous World
38mKeeping Secrets - A Practical Approach to Managing Credentials
30mBehind Closed Doors: Managing Passwords in a Dangerous World
47mManaging your Secrets in a Cloud Environment
28mHow to Store Secrets—and When Do You Need Them—in HashiCorp Vault
26mHow To Keep A Secret
34mWhich Vault? Don't tell me your secret(s)!