Bosh Vault: Secretless Bosh Manifests and Vault
summary
An open source config server called bosh-vault implements BOSH’s config server API using HashiCorp Vault as the backend, written in Go and packaged as a BOSH release or standalone binary. It verifies UAA JWTs, requires Vault KV-v2 and a periodic token, supports dynamic secret engines that generate and auto-rotate database credentials, and adds a redirects feature to migrate v1 stores and aggregate external vaults. The demo shows live credential rotation working and automated expiry cleanup.
AI-written summary · about
chapters (17)
- 0:00Start
- 0:56What's wrong with manifests?
- 2:45About 1 year ago...
- 3:36Example Dynamic Secret Engine
- 4:10Vault is still my favorite software
- 7:12What is config server?
- 8:22Why Bosh Vault?
- 9:08What can Bosh Vault do?
- 10:11Deploying
- 11:22Deployment: Ideal
- 12:53Deployment: Alternative
- 14:02How is Bosh Vault configured?
- 15:57Redirects: Configuration
- 16:48Redirect: upstream
- 18:02Redirect: v1
- 19:06Redirect: dynamic
- 20:35How is Bosh Vault tested?
related talks
33mBosh Vault: Secretless Bosh Manifests and Vault
28mConfiguring a More Secure BOSH [I]
40mA Better Way To Manage Secrets
30mEfficiently share and manage secrets across applications with HashiCorp Vault
28mSecret Management with Hashicorp´s Vault
42mZero-Knowledge Architecture, or Leak-Free Secrets, with HC Vault
43mSecret Management with Hashicorp's Vault
44mSecret Management with Hashicorp's Vault