Bosh Vault: Secretless Bosh Manifests and Vault
summary
Config server implementation bosh-vault lets BOSH talk to HashiCorp Vault (21 supported backends), implemented as a stateless Go service that needs no BOSH code changes. It uses redirects to map manifest variable refs to Vault paths (cached in KV-v2), supports Vault dynamic secret engines with leases and revocation, uses periodic Vault tokens for renewal, and can run as a sidecar or BOSH release. Demo shows live credential rotation, redeploy behavior, and migration from KV-v1 to KV-v2.
AI-written summary · about
chapters (16)
- 0:00Start
- 0:26Config Server
- 3:42Vault is my favorite software
- 5:16What can bosh-vault do?
- 7:00Deployment Option
- 7:19Deployment: Ideal
- 8:53What's a Redirect?
- 10:59Redirects: Upstream
- 13:00Dynamic Secrets Engine
- 13:51Redirect Dynamic
- 14:34Sharp Things Can Cut You
- 16:43Vault Setup
- 19:08UAA Setup
- 19:55The Full Setup Story
- 21:03Bosh Setup
- 29:03Demo Time
related talks
27mBosh Vault: Secretless Bosh Manifests and Vault
44mSecret Management with Hashicorp's Vault
30mEfficiently share and manage secrets across applications with HashiCorp Vault
40mA Better Way To Manage Secrets
28mConfiguring a More Secure BOSH [I]
42mZero-Knowledge Architecture, or Leak-Free Secrets, with HC Vault
28mSecret Management with Hashicorp´s Vault
51mIntroduction to Vault