Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Secure Your Secrets in GitOps
Search
Sponsored
·
Ship Features Fearlessly
Turn features on and off without deploys. Used by thousands of Ruby developers.
→
Rosemary Wang
May 19, 2022
Programming
1
110
Secure Your Secrets in GitOps
Learn how to inject secrets into your applications with Flux, a GitOps tool on Kubernetes.
Rosemary Wang
May 19, 2022
Tweet
Share
More Decks by Rosemary Wang
See All by Rosemary Wang
Build for massive scale & security with the HashiCorp Cloud Platform
joatmon08
0
72
People, process, and technology for ILM and SLM adoption
joatmon08
0
59
Secure Day 2 operations with Boundary and Vault
joatmon08
0
69
Can You Test Your Infrastructure as Code?
joatmon08
1
100
Multi-Account, Multi-Region, Multi-Runtime
joatmon08
1
65
Building a multi-account, multi-runtime service-oriented architecture
joatmon08
0
77
Choose Your Own Abstraction: Iterating on Developer Experience
joatmon08
0
100
Break Glass, Repair Fast, Reconcile Automation
joatmon08
1
75
Building a Developer Platform? Ask these questions.
joatmon08
0
87
Other Decks in Programming
See All in Programming
AIによる高速開発をどう制御するか? ガードレール設置で開発速度と品質を両立させたチームの事例
tonkotsuboy_com
7
2.2k
Automatic Grammar Agreementと Markdown Extended Attributes について
kishikawakatsumi
0
180
なるべく楽してバックエンドに型をつけたい!(楽とは言ってない)
hibiki_cube
0
140
IFSによる形状設計/デモシーンの魅力 @ 慶應大学SFC
gam0022
1
300
Implementation Patterns
denyspoltorak
0
280
組織で育むオブザーバビリティ
ryota_hnk
0
170
Package Management Learnings from Homebrew
mikemcquaid
0
210
登壇資料を作る時に意識していること #登壇資料_findy
konifar
4
1k
AI時代の認知負荷との向き合い方
optfit
0
150
20260127_試行錯誤の結晶を1冊に。著者が解説 先輩データサイエンティストからの指南書 / author's_commentary_ds_instructions_guide
nash_efp
1
940
Unicodeどうしてる? PHPから見たUnicode対応と他言語での対応についてのお伺い
youkidearitai
PRO
1
2.5k
Amazon Bedrockを活用したRAGの品質管理パイプライン構築
tosuri13
4
270
Featured
See All Featured
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.6k
Building a Scalable Design System with Sketch
lauravandoore
463
34k
Ten Tips & Tricks for a 🌱 transition
stuffmc
0
65
Gemini Prompt Engineering: Practical Techniques for Tangible AI Outcomes
mfonobong
2
280
Paper Plane (Part 1)
katiecoart
PRO
0
4k
B2B Lead Gen: Tactics, Traps & Triumph
marketingsoph
0
53
Site-Speed That Sticks
csswizardry
13
1.1k
Heart Work Chapter 1 - Part 1
lfama
PRO
5
35k
Building a Modern Day E-commerce SEO Strategy
aleyda
45
8.6k
Exploring the relationship between traditional SERPs and Gen AI search
raygrieselhuber
PRO
2
3.6k
A better future with KSS
kneath
240
18k
JAMstack: Web Apps at Ludicrous Speed - All Things Open 2022
reverentgeek
1
320
Transcript
Copyright © 2022 HashiCorp Secure Your Secrets in GitOps May
19, 2021 Rosemary Wang Developer Advocate at HashiCorp she/her @joatmon08 1
Works, but not ideal. Use SOPS to encrypt and store
in version control. 1 2 3 fluxcd.io/docs/guides/mozilla-sops/#encrypting-secrets-using-hashicorp-vault SOPS 2. Commit encrypted secret to version control. 1. Use encryption key from Vault to encrypt secret. 2
What happens when you accidentally commit a plaintext secret? 3
1. Regret 2. Revoke 3. Rotate 4. Reference 5. Replace
6. Re-run Plan R AKA Remediation 4
Is there a better way? 5
Kubernetes Secret Plaintext 😨 Needs role-based access controls 🤔 Secrets
Manager Securely stores secrets (Some) Rotate secrets for you Audits access Securing Secrets Credentials, Tokens, Keys, Certificates 6
Secrets Manager + Kubernetes Use file-based secrets injection with Secrets
Store CSI Driver. 1 2 3 secrets-store-csi-driver.sigs.k8s.io/ vaultproject.io/docs/platform/k8s/csi @joatmon08 7
If you still need Kubernetes secrets… Sync as Kubernetes Secret
with Secrets Store CSI Driver. 1 2 3 8
github.com/ joatmon08/ hashicorp-vault-flux 9
1. hashicorp.com/blog/manage-kubernetes-secrets- for-flux-with-hashicorp-vault 2. fluxcd.io/docs/guides/mozilla-sops/#encrypting-s ecrets-using-hashicorp-vault 3. secrets-store-csi-driver.sigs.k8s.io/ 4. vaultproject.io/docs/platform/k8s/csi
5. vaultproject.io/docs/platform/k8s/injector Resources 10
Copyright © 2022 HashiCorp Thank you! May 19, 2021 Rosemary
Wang @joatmon08 joatmon08.github.io 11