Changing Applications for Changing Secrets
summary
Demo shows a Go payments app on Kubernetes using HashiCorp Vault to issue dynamic database credentials that rotate (demo TTL ~2–3 minutes, tested down to 10s). Vault runs with the Vault agent injector sidecar which writes templated secrets to files; the agent calls the app’s /reload endpoint (wget) after rotation. The app closes old DB connections, reloads credentials from files, and the live reload works in the demo.
AI-written summary · about
chapters (8)
- 0:00Managing secrets in Kubernetes
- 6:27Getting secrets from Vault
- 9:16Vault SDK for dynamic credentials
- 15:41Outsourcing credentials with Vault agent
- 18:09Configuring Vault agent in Kubernetes
- 25:36Live reload for secrets
- 36:59Static vs dynamic credentials
- 40:44Q&A
related talks
26mRefactoring Applications for Dynamic Secrets
47mThe Secret to Handling Dynamic Secrets
29mHow to get dynamic with secrets management
30mEfficiently share and manage secrets across applications with HashiCorp Vault
40mA Better Way To Manage Secrets
28mSecret Management with Hashicorp´s Vault
32mIntegrating HashiCorp Vault and K8s Apps - No Code Changes Needed
31mModern Security with Microservices and the Cloud