Vault and Secret Management in Kubernetes
summary
Vault provides a single secrets broker that generates dynamic secrets (unique DB users and passwords) with TTL-based leases that can be renewed or revoked, uses AES-256 and TLS1.2, and supports HA (Consul/etcd/ZooKeeper) and Shamir unseal key splitting for safe startup. Kubernetes pods authenticate via service account JWT verified with the TokenReview API to mint Vault tokens, enabling on-demand DB credentials, TLS certs, encryption-as-a-service, and audit-backed non-repudiation; Vault 0.9 adds first-class entity identity and group mapping across providers.
AI-written summary · about
chapters (12)
- 0:00Introduction to HashiCorp
- 1:03Introduction to Vault
- 3:50The Secret Sprawl Problem
- 5:46Vault Design Principles
- 7:11Secure Secret Storage
- 10:02Dynamic Secrets and Leases
- 12:50Revocation and Forensics
- 14:32Auth and Auditing
- 16:44High Availability and Unsealing
- 21:12Identity Management Features
- 24:17Kubernetes Integration
- 29:08Summary and Conclusion
related talks
08mKubernetes Secret Management The Right Way With Vault
23mVault for Secrets Management and TLS in Consul K8s
49mManaging Secrets in a Kubernetes Cluster with Hashicorp Vault
41mEasy Secrets in Kubernetes: Because I Vault It Well
51mIntroduction to Vault
43mSecret Management with Hashicorp's Vault
28mSecret Management with Hashicorp´s Vault
39mManaging and securing Kubernetes secrets - Simon Pearce