Bringing in Compliance for Public
summary
Implementation uses Barbican + HSM with Castellan and PKCS#11: HSM stores a master key and HMAC, per-project keys are encrypted by the master, and secrets decrypt only via HSM. Vault is dropped because it lacks tenant isolation without Enterprise. Deployment with OpenStack Ansible is straightforward, but server-side object encryption causes scaling pain — a 2 GB file in 8 MB chunks becomes 256-part multipart uploads triggering many HSM operations and rate limits. Octavia certificate flow and live-migration secret sharing remain operational gaps.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:25City Network became Cleural
- 4:12What is compliance?
- 6:17Selecting backende
- 9:09What do we want to have?
- 12:14Vault backend
- 14:50Simple Barbican
- 18:37Object Storage server-side encryption
- 22:28Octavia, Barbican, Keystone and application credentials
- 24:10Operations
related talks
47mSecuring Customer Secrets with Barbican and HSMs
26mCombining DevOps with PKI Compliance Using HashiCorp Vault & Consul
51mIntroduction to Vault
44mSecret Management with Hashicorp's Vault
38mKeeping Secrets - A Practical Approach to Managing Credentials
28mEmbedding secrets governance into the enterprise through organizational change
43mSecret Management with Hashicorp's Vault
51mRun modern PKI workflows with HCP Vault on AWS