Hiding secrets in a Vault
summary
Vault is a HashiCorp service that encrypts secrets before storing them in a chosen backend and enforces unsealing with Shamir secret sharing so that an initialization can create 5 unseal keys, threshold 3 and a single powerful root token. It supports GitHub auth for team-based policies, issues short-lived tokens, logs access, and can generate dynamic AWS credentials on demand. A Ruby "secret CLI" was built to init, diff, push and pull secrets because Vault has no built-in versioning and CI/servers pull secrets at deploy time.
AI-written summary · about
chapters (6)
related talks
50mDevOps: Shhhh! It's a secret! - HashiCorp Vault
28mHow to Store Secrets—and When Do You Need Them—in HashiCorp Vault
40mA Better Way To Manage Secrets
43mSecret Management with Hashicorp's Vault
30mEfficiently share and manage secrets across applications with HashiCorp Vault
51mIntroduction to Vault
34mWhich Vault? Don't tell me your secret(s)!
38mKeeping Secrets - A Practical Approach to Managing Credentials