Using CredHub to Increase the Security of Your Platform - Dan Jahner, Pivotal
summary
CredHub centralizes credential generation, encrypted storage, rotation and access control for Cloud Foundry, replacing inline secrets in BOSH and Concourse manifests with references so manifests and BOSH DB no longer hold passwords or private keys. It generates CA and signed certs on demand, adds audit logging and mutual-auth access for apps via a launcher or direct client, supports an AES provider and Luna HSM client, and is in Pivotal production use for ~8 months while rotation pending further automation.
AI-written summary · about
chapters (31)
- 0:00Intro
- 0:20Agenda
- 0:43Why Create Credit
- 1:24Cloud Foundry
- 1:52Risk
- 2:45What is CredHub
- 6:37Live Demos
- 7:34Director Configuration
- 8:32Director Deployment
- 10:36Bosch
- 11:05Future State
- 13:26No More Credentials
- 14:05BeforeAfter
- 14:25Recap
- 15:35Deployment
- 16:04Updates
- 19:49Checking Get Pipeline Manifest
- 21:59State Diagram
- 22:54Alternative Workflow
- 23:14Credential provisioning
- 24:16Credential consumption
- 25:51Credentials in applications environment
- 26:58Rotation
- 28:09Wrap Up
- 29:36Internal Audit
- 30:00Pen Tests
- 30:42Encryption Providers
- 32:04Variables
- 33:13Restrictions
- 34:20Credential Rotation
- 35:47Production Readiness
related talks
36mCredHub and Secure Credential Management - Peter Blum, Scott Frederick
17mVault and Credhub: Better Together
25mHandling Secrets in Your Cloud Native Architecture
28mConfiguring a More Secure BOSH [I]
26mKeynote: A Platform for the Enterprise: Where Maturity and Innovation Intersect
24mRoche: Securing & Connecting Healthcare Platforms
38mKeeping Secrets - A Practical Approach to Managing Credentials
26mPreflight Platform Checklist - A Mechanic's Guide