CI CasC integration with Secrets Manager (PRT071)

on YouTube ↗15m

" summary

Live demo shows CloudBees CI controllers on Amazon EKS pulling credentials from AWS Secrets Manager at runtime using Secrets Store CSI Driver and IAM roles for service accounts. Helm deploys CloudBees and the AWS CSI provider, GitHub App triggers a CasC bundle to create a new controller, and an IAM policy with KMS decrypt permission allows Secrets Manager secrets to mount into the JCasC volume. The dynamic provisioning completes and the secrets are verifiably present on the new controller.

AI-written summary · about

" chapters (8)

1. 0:00Introduction to CloudBees CI
2. 1:25What is Configuration as Code
3. 4:18Demo setup and architecture overview
4. 6:31IAM and Secrets Manager integration
5. 8:39GitHub app and dynamic provisioning
6. 10:04JCasC bundle and secrets management
7. 12:34Verifying secrets in new controller
8. 13:40Operation Center and summary

" related talks

• 30mLook Ma, No secrets in my Kubernetes Cluster! - Vijay DharapVijay Dharap · ContainerDays 2023
• 55mHandling secrets in cloud-based applicationsSteve Roberts · NDC Sydney 2020
• 36mSecrets Store CSI Driver-Bring Your Own Enterprise Secrets Store to K8sRita Zhang · KubeCon + CloudNativeCon Europe 2019
• 20mApplication Secret Management with AWS KMSAndrey Utis · DevOpsDays Philadelphia 2016
• 24mSecrets Store CSI Driver: Keeping Secrets SecretAnish Ramasekar, Tommy Murphy · KubeCon + CloudNativeCon Europe 2021
• 41mSIG AWS Update - Justin Santa BarbaraJustin Santa Barbara · KubeCon + CloudNativeCon Europe 2018
• 24mCan You Keep a Secret? On Secret Management in KubernetesLiav Yona, Gal Cohen · KCD Ukraine 2023
• 39mControlled Mayhem With Cloud Native Security PipelinesBen Pick · OWASP Global AppSec Amsterdam 2019