Vault Automation with the HashiCorp Stack in OneMount
summary
OneMount builds a Vault-backed secret and PKI platform on GCP using Vault PKI, GCP KMS for unseal keys and image-based deployments with Terraform + Packer, automated via GitLab CI/CD. Applications on ~100 GKE clusters authenticate with Workload Identity and JWT to get short‑lived certs and secrets; Vault issues and stores certificates and keys. Production scale shows about 300 applications, ~3,000 certificates/tokens and hundreds of users, and the system reliably serves cert issuance, rotation and secret retrieval.
AI-written summary · about
chapters (6)
- 0:00Introduction and team overview
- 3:43Secret management challenges
- 8:14Vault deployment on GCP
- 12:52PKI and certificate management
- 15:23PII encryption and anonymization
- 18:14Results and future plans
related talks
23mManaging Vault with Terraform
49mUsing HashiCorp Vault with Kubernetes
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes
23mHashiCorp Vault and Getting Day 2 Operations Right
41mAutomating Multi-Cloud, Multi-Region Vault for Teams and Landing Zones
27mVault At Scale
29mAutomating Vault deployments: Patterns, pitfalls, and practical lessons
29mUsing HashiCorp Vault with Google's Serverless Solutions