Vault Response Wrapping Makes Secret Zero Challenge A Piece Of Cake
summary
Shows a working Jenkins-to-Vault pipeline that uses Vault response wrapping to hand off a wrapped token instead of a raw secretID. Jenkins (trusted entity) uses an AppRole roleID/secretID pair to create a wrapped token with a short TTL, the spawned pipeline unwraps once to receive the secretID, then logs in with roleID+secretID to obtain a Vault client token and read secrets. Demo succeeds end-to-end and reproduces a failure: omitting the -wrap-ttl option causes Vault to deny the write.
AI-written summary · about
chapters (8)
- 0:00Introduction to Vault
- 1:36AppRole authentication
- 4:01The secret zero challenge
- 6:10Implementing response wrapping
- 10:11Configuration and workflow
- 14:04Best practices and security
- 18:29Live demo and validation
- 23:08Conclusion and Q&A
related talks
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
25mCan you keep a secret?
41mHiding secrets in a Vault
30mHashiCorp Vault and Jenkins - Leveraging AWS IAM to Empower a Hybrid Scenario
38mDon’t Break Your Pasta! Good Practices for Securing Your Pipelines
38mKeeping Secrets - A Practical Approach to Managing Credentials
24mSecrets as Code
28mSecret Management with Hashicorp´s Vault