Don’t Break Your Pasta! Good Practices for Securing Your Pipelines
summary
Shows how to avoid long‑lived secrets in pipelines by using HashiCorp Vault as an identity broker: Jenkins running in a k3d Kubernetes cluster authenticates to Vault with its service account JWT, Vault mints dynamic short‑lived credentials (demo uses 15‑minute TTL) that Terraform Cloud consumes to provision resources. The demo uses Terraform Cloud, Vault, Jenkins, Packer for golden images, and a local k3d testbed, with Sentinel policies enforcing tags and cost limits and the pipeline completing successfully.
AI-written summary · about
chapters (7)
- 0:00Pipeline security intro
- 5:04Zero Trust multicloud
- 11:26Secure pipeline practices
- 16:38Dynamic secrets management
- 24:19Vault Terraform demo
- 32:56Security by design summary
- 33:42Q&A
related talks
31mSecure Your Multi-Cloud Delivery Pipeline with HashiCorp Vault
25mSecure Your Terraform Deploys in GitLab-CI with HashiCorp Vault
38mKeeping Secrets - A Practical Approach to Managing Credentials
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
30mHashiCorp Vault and Jenkins - Leveraging AWS IAM to Empower a Hybrid Scenario- 33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
39mBuilding Efficient Continuous Integration Pipelines with Nomad, Vault and Jenkins