Secrets in Java Services on Spring: Where to Store Them and How to Hot-Reload Them
summary
Explains how to securely retrieve secrets from HashiCorp Vault into a Java application and inject the retrieved secret files into a Spring Boot app at startup. Describes a method to update secrets “hot” under load—without restarting the service or using a rolling update—and demonstrates the approach on the Platform V Sessions Data service.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:52Talk goals and agenda
- 4:07Why services need secrets
- 7:16Secret providers and integration
- 10:05Using secrets in Java code
- 16:38Secret rotation issues and nuances
- 25:24Hot rotation solution
- 33:12File change monitoring
- 34:16Updating server SSL certificates
- 36:52Updating client SSL certificates
- 38:37Updating DB credentials
- 40:25Avoiding peak loads
- 43:17Summary and recommendations
- 45:05Q&A
related talks
53mSecuring Spring Applications with Hashicorp Vault
26mRefactoring Applications for Dynamic Secrets
47mThe Secret to Handling Dynamic Secrets
42mSpring Vault - managing secrets at scale
28mHow to Store Secrets—and When Do You Need Them—in HashiCorp Vault
52mManaging Spring Boot Application Secrets
36mManage Distributed Secrets in Applications on Cloud Foundry With Spring Cloud Vault
51mManage Distributed Configuration and Secrets with Spring Cloud and Vault