Vault Fastly Secret Engine Design and Integration
summary
NYT replaces dozens of static Fastly tokens with a Vault secret engine plugin that generates dynamic short-lived tokens on demand via the Fastly API using an admin account plus TOTP, defaulting to TTL 5 minutes. Tokens move out of Drone secrets into Vault; Drone and Terraform fetch tokens at build time. Plugin is a standalone binary distributed in a Docker image and registered with Vault; it creates and auto-revokes tokens so there are no long-term tokens, solving the 100-token limit and working in HA Vault.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:04Fastly overview and challenges
- 6:07Current token management issues
- 7:55First improvement with Vault
- 9:00Vault Fastly secret engine design
- 15:05Development and demo process
- 19:27Integration with Drone CI
- 23:06Future plans and open sourcing
- 24:27Q&A on availability and performance
related talks
29mHow to get dynamic with secrets management
31mUsing dynamic secrets for third-party Kubernetes applications at scale
47mThe Secret to Handling Dynamic Secrets
51mIntroduction to Vault
38mKeeping Secrets - A Practical Approach to Managing Credentials
28mSecret Management with Hashicorp´s Vault
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
31mVault and Secret Management in Kubernetes