Vault and Credhub: Better Together
Talkat Cloud Foundry Day North America 2024 · on Wednesday, 2024-05-15· at 14:15· Education Center, 2nd Floor·
summary
A hybrid secrets workflow uses Vault as single source of truth while CredHub stores deployment-time values via CredHub holds deployment secrets with fingerprinted signatures, with Genesis and Spruce glue to validate, copy and render manifests. Implementation copies secrets from Vault into CredHub at deploy, validates presence, and can auto-rotate X.509 CAs while preserving keys so leaf certs remain valid — a pragmatic tradeoff that reduces surprise and the three-step CA redeploy nightmare.
AI-written summary · about
chapters (9)
- 0:00Introduction and agenda
- 1:04Introducing Vault and CredHub
- 3:36Demo: Deploying with CredHub alone
- 6:27Why Vault is better together
- 8:16Integrating Vault with CredHub
- 10:24Enhancing security with CredHub
- 12:51Fixing warnings and deploying
- 13:55Certificate rotation explained
- 16:26Conclusion and resources
related talks
38mKeeping Secrets - A Practical Approach to Managing Credentials
37mUsing CredHub to Increase the Security of Your Platform - Dan Jahner, Pivotal
36mCredHub and Secure Credential Management - Peter Blum, Scott Frederick
25mHandling Secrets in Your Cloud Native Architecture
41mHiding secrets in a Vault
28mEmbedding secrets governance into the enterprise through organizational change
24mSecrets at Scale with Vault and Waypoint
31mSecure Your Multi-Cloud Delivery Pipeline with HashiCorp Vault