The Secret to Handling Dynamic Secrets
summary
Shows concrete patterns and working code: uses Vault with a Vault Secrets operator on Kubernetes to inject secrets, demos a dynamic DB credential that leases out and is revoked (example lease set to 3 minute lease), and contrasts an application-agnostic operator-driven rollout vs an application-aware Spring Boot approach using spring Cloud Vault for in-process refresh. Explains graceful shutdown, connection re‑creation, retry and caching rules, and what failed or required extra refactor.
AI-written summary · about
chapters (22)
- 0:00Introduction to Dynamic Secrets
- 0:35Challenges of Centralizing Secrets
- 1:12Secret Rotation and Application Coordination
- 2:28Automating Secret Management
- 2:54Developer Enablement for Dynamic Secrets
- 4:17Types of Secrets: Static, Rotated, and Dynamic
- 6:51Handling Dynamic Secrets in Applications
- 9:26Application Agnostic Approach
- 21:43Application Aware Approach
- 22:12Introduction to Secrets Management
- 23:08Graceful Shutdown and Connection Handling
- 24:11Spring Boot Integration with Vault
- 25:11Handling Secrets in Different Frameworks
- 25:47Setting Up Spring Cloud Vault
- 27:47Refreshing Secrets in Applications
- 29:01Dynamic Secrets and Event Subscriptions
- 30:13Reloading Objects with New Credentials
- 32:31Running the Application and Handling Retries
- 34:43Application Agnostic vs. Application Aware Approaches
- 38:28Assessing Your Applications and Frameworks
- 41:59Developer Enablement and Best Practices
- 45:51Conclusion and Final Thoughts
related talks
42mSpring Vault - managing secrets at scale
26mRefactoring Applications for Dynamic Secrets
42mDynamic credentials for Kubernetes workloads with Vault and VSO
41mEasy Secrets in Kubernetes: Because I Vault It Well
41mChanging Applications for Changing Secrets
29mIntro to secrets management using Vault
53mSecuring Spring Applications with Hashicorp Vault
51mManage Distributed Configuration and Secrets with Spring Cloud and Vault