Air Marshal: No More Secrets In Your Manifests
summary
Air Marshal acts as a proxy between CLI and BOSH/Concourse, accepting manifests with placeholders in manifests and looking up secrets from a secure back end (Vault, KMS, or similar) to inject before forwarding to BOSH or Concourse. It removes secrets from source control and local disks, prototypes exist, integrates with Genesis/spruce and fly, and supports configurable secret back ends. It explicitly does not protect against malicious insiders and focuses on reducing external‑attack and human‑error risk.
AI-written summary · about
chapters (9)
- 0:00Introduction and setup
- 1:45Secrets in source control risks
- 3:54Human error and mitigation
- 5:41Local disk secrets trade-offs
- 7:03Genesis Spruce Vault workflow
- 8:25Introducing Air Marshal
- 10:37Audience poll on tools
- 12:26Compliance and access control
- 14:13Q&A session begins
related talks
38mKeeping Secrets - A Practical Approach to Managing Credentials
25mHandling Secrets in Your Cloud Native Architecture
01h 02mSecret Management: The Soft Way
33mBosh Vault: Secretless Bosh Manifests and Vault
47mManaging your Secrets in a Cloud Environment
47mSecrets Management in Mesos
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter
29mManaging Secrets in Your Cloud Environment