Secrets Management at Swiss Federal Railways (SBB)
summary
Swiss Federal Railways deploys HashiCorp Vault into OpenShift with a primary and DR cluster, S3 snapshots, AWS KMS auto-unseal, Prometheus and Splunk for telemetry, and GitOps (Terraform + Argo CD) to manage config. A custom self-service portal provisions app spaces, Git repos and Vault paths, and onboarding uses Azure AD SSO. The project fills Vault with real secrets, supports dynamic DB credentials roadmap, and went live in under six months with a production ramp-up showing the platform is operational and already in use.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:36About Switzerland
- 2:20About SBB
- 3:14About punctuality
- 4:04About new customers
- 4:19What do you need
- 5:12How it started
- 6:10Why we chose Vault
- 6:53Initial plan
- 7:30Ecosystem
- 9:16Online shop
- 10:11Baseline
- 10:32Team
- 12:11Platform Readiness
- 15:13Service Readiness
- 17:09Governance
- 19:01SelfService Portal
- 21:51Vault in 6 months
- 22:30Future plans
- 26:19Conclusion
related talks
38mKeeping Secrets - A Practical Approach to Managing Credentials
40mA Better Way To Manage Secrets
43mSecret Management with Hashicorp's Vault
34mWhich Vault? Don't tell me your secret(s)!
12mCentralize and manage secrets with HashiCorp Cloud
30mEfficiently share and manage secrets across applications with HashiCorp Vault
28mEmbedding secrets governance into the enterprise through organizational change
50mDevOps: Shhhh! It's a secret! - HashiCorp Vault