Which Vault? Don't tell me your secret(s)!
summary
Compares three concrete secret stores for an OpenShift container platform: CyberArk Conjur, HashiCorp Vault, and Kubernetes Sealed Secrets. Builds an MVP using Sealed Secrets as a short‑term rescue (encrypted YAML stored in repos, operator holds private key), but it lacks dynamic rotation so scripts are needed. Vault offers dynamic secrets and encryption but is tied to a licensed ops pipeline component, making costs prohibitive. Conjur provides centralized policy engine, audit trail and automatic rotation and is adopted as the long‑term solution for the platform.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker intro
- 1:51Why secret management matters
- 5:45Container platform risks
- 11:21Secret management options explored
- 16:00Challenges in secret management
- 18:49Three tools compared
- 28:31Best practices for secrets
- 31:42Q&A on licensing and tools
related talks
41mHiding secrets in a Vault
28mHow to Store Secrets—and When Do You Need Them—in HashiCorp Vault
50mDevOps: Shhhh! It's a secret! - HashiCorp Vault
51mIntroduction to Vault
20mEvolving Kubernetes security with Vault and OpenShift
31mVault and Secret Management in Kubernetes
41mModern Security with Microservices and the Cloud
41mEasy Secrets in Kubernetes: Because I Vault It Well