Attackers' Nightmare: An Infrastructure Without Secrets
summary
A plan to eliminate long‑lived credentials by replacing passwords with short‑lived tokens and automation: adopt SSO and OIDC for developer access, move CI pipelines to OIDC so workflows assume roles (including a GitHub Actions demo), and centralize runtime secrets in Vault with dynamic database credentials so each pod gets its own user. The roadmap includes rotating machine credentials down to 15 minutes, scanning to detect legacy plaintext secrets, phasing out static secrets, adding non‑regression checks, and enabling per‑pod auditability.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 8:11Long-term secret problems
- 12:47Developer secret management
- 17:06OIDC demo for CI/CD
- 23:53Kubernetes workload secrets
- 30:05Volt and PostgreSQL demo
- 42:51Summary and best practices
- 44:40Q&A
related talks
46mThe Nightmare for Attackers: An Infrastructure without Secrets
05mBreaking Up with Long-lived Secrets: Secure Automation in the Mode...
24mDeveloper-First Application Security and DevSecOps
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
38mKeeping Secrets - A Practical Approach to Managing Credentials
34mThrow Away Your Passwords: Trusting Workload Identity
22mFast Secrets: Why Secrets Need to Match the Infrastructure
30mLong Live Short Lived Credentials - Auto-rotating Secrets At Scale