Integrating Vault with CI/CD pipelines: Best practices and pitfalls
summary
Claims that using Vault with GitHub Actions, GitLab CI and Jenkins eliminates static bootstrap secrets by using workload identity (OIDC) and short-lived tokens; shows a demo creating dynamic JWT roles per action/environment with 10-minute TTLs, and contrasts a leaking manual JWT workflow with a masked GitLab-native secret injection that succeeds. Notes Kubernetes options (Agent Injector, CSI, service‑account auth), Jenkins workspace leakage risk, and recommends clean workspaces, per-step child tokens, short secret TTLs and masking logs.
AI-written summary · about
chapters (9)
- 0:00Introduction and speakers
- 2:02CI/CD security challenges
- 4:51Workload identity overview
- 6:51Vault and GitHub Actions demo
- 14:11GitLab developer workflow
- 18:04Kubernetes integration options
- 19:04Jenkins plugin pitfalls
- 21:03Secret lifecycle best practices
- 23:20Production secret management
related talks
24mDeveloper-First Application Security and DevSecOps
28mSecure CI/CD Using JSON Web Token (JWT)
30mHashiCorp Vault and Jenkins - Leveraging AWS IAM to Empower a Hybrid Scenario
25mSecure Your Terraform Deploys in GitLab-CI with HashiCorp Vault
45mAttackers' Nightmare: An Infrastructure Without Secrets
28mSecret Management with Hashicorp´s Vault
25mCan you keep a secret?
38mKeeping Secrets - A Practical Approach to Managing Credentials