Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Secure Your Secrets in GitOps
Search
Rosemary Wang
May 19, 2022
Programming
1
90
Secure Your Secrets in GitOps
Learn how to inject secrets into your applications with Flux, a GitOps tool on Kubernetes.
Rosemary Wang
May 19, 2022
Tweet
Share
More Decks by Rosemary Wang
See All by Rosemary Wang
Build for massive scale & security with the HashiCorp Cloud Platform
joatmon08
0
20
People, process, and technology for ILM and SLM adoption
joatmon08
0
11
Secure Day 2 operations with Boundary and Vault
joatmon08
0
33
Can You Test Your Infrastructure as Code?
joatmon08
1
65
Multi-Account, Multi-Region, Multi-Runtime
joatmon08
1
37
Building a multi-account, multi-runtime service-oriented architecture
joatmon08
0
46
Choose Your Own Abstraction: Iterating on Developer Experience
joatmon08
0
49
Break Glass, Repair Fast, Reconcile Automation
joatmon08
2
46
Building a Developer Platform? Ask these questions.
joatmon08
0
45
Other Decks in Programming
See All in Programming
お前もAI鬼にならないか?👹Bolt & Cursor & Supabase & Vercelで人間をやめるぞ、ジョジョー!👺
taishiyade
7
4.2k
TCAを用いたAmebaのリアーキテクチャ
dazy
0
210
LINE messaging APIを使ってGoogleカレンダーと連携した予約ツールを作ってみた
takumakoike
0
120
CDKを使ったPagerDuty連携インフラのテンプレート化
shibuya_shogo
0
110
PEPCは何を変えようとしていたのか
ken7253
3
290
CloudNativePGを布教したい
nnaka2992
0
120
コミュニティ駆動 AWS CDK ライブラリ「Open Constructs Library」 / community-cdk-library
gotok365
2
250
Jasprが凄い話
hyshu
0
180
「個人開発マネタイズ大全」が教えてくれたこと
bani24884
1
270
生成AIで加速するテスト実装 - ロリポップ for Gamersの事例と 生成AIエディタの活用
kinosuke01
0
130
Swift Testingのモチベを上げたい
stoticdev
2
140
技術を改善し続ける
gumioji
0
150
Featured
See All Featured
Code Reviewing Like a Champion
maltzj
521
39k
The Pragmatic Product Professional
lauravandoore
32
6.4k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
175
52k
Adopting Sorbet at Scale
ufuk
75
9.2k
A better future with KSS
kneath
238
17k
Fireside Chat
paigeccino
35
3.2k
Practical Tips for Bootstrapping Information Extraction Pipelines
honnibal
PRO
13
1k
Practical Orchestrator
shlominoach
186
10k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
3.7k
Bash Introduction
62gerente
611
210k
The Illustrated Children's Guide to Kubernetes
chrisshort
48
49k
A designer walks into a library…
pauljervisheath
205
24k
Transcript
Copyright © 2022 HashiCorp Secure Your Secrets in GitOps May
19, 2021 Rosemary Wang Developer Advocate at HashiCorp she/her @joatmon08 1
Works, but not ideal. Use SOPS to encrypt and store
in version control. 1 2 3 fluxcd.io/docs/guides/mozilla-sops/#encrypting-secrets-using-hashicorp-vault SOPS 2. Commit encrypted secret to version control. 1. Use encryption key from Vault to encrypt secret. 2
What happens when you accidentally commit a plaintext secret? 3
1. Regret 2. Revoke 3. Rotate 4. Reference 5. Replace
6. Re-run Plan R AKA Remediation 4
Is there a better way? 5
Kubernetes Secret Plaintext 😨 Needs role-based access controls 🤔 Secrets
Manager Securely stores secrets (Some) Rotate secrets for you Audits access Securing Secrets Credentials, Tokens, Keys, Certificates 6
Secrets Manager + Kubernetes Use file-based secrets injection with Secrets
Store CSI Driver. 1 2 3 secrets-store-csi-driver.sigs.k8s.io/ vaultproject.io/docs/platform/k8s/csi @joatmon08 7
If you still need Kubernetes secrets… Sync as Kubernetes Secret
with Secrets Store CSI Driver. 1 2 3 8
github.com/ joatmon08/ hashicorp-vault-flux 9
1. hashicorp.com/blog/manage-kubernetes-secrets- for-flux-with-hashicorp-vault 2. fluxcd.io/docs/guides/mozilla-sops/#encrypting-s ecrets-using-hashicorp-vault 3. secrets-store-csi-driver.sigs.k8s.io/ 4. vaultproject.io/docs/platform/k8s/csi
5. vaultproject.io/docs/platform/k8s/injector Resources 10
Copyright © 2022 HashiCorp Thank you! May 19, 2021 Rosemary
Wang @joatmon08 joatmon08.github.io 11