Forget About DB Credentials with Terraform, Vault and Kubernetes
summary
Provisioned databases use Vault as the only holder of a usable root password, with Terraform automating DB, role and policy setup and Kubernetes using the k8s auth method to bind leases to pods. Applications get dynamic credentials with short TTLs (example: one hour) and can be auto-revoked or rotated; restarting pods forces new credentials. Vault Agent and consul-template render secrets into containers for apps that can’t use a library, and revocation plus root rotation minimizes attack surface and audit trails.
AI-written summary · about
chapters (5)
related talks
31mVault and Secret Management in Kubernetes
31mHashiCorp Vault Configuration as Code via HashiCorp Terraform: Stories From the Trenches
29mAuto-Configure Your Vault and Boundary With CTS
23mManaging Vault with Terraform
28mSelf-Service Vault in Kubernetes
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
42mDynamic credentials for Kubernetes workloads with Vault and VSO
42mManage Vault programmatically with Terraform