Vault Wrangling with Teller

Transcript

1. Vault wrangling with Teller Dotan Nahum github.com/jondot Founder & CEO @ Spectral github.com/spectralops/teller
2. About me • Founder & CEO @ Spectral • Blackhat 95-01’ (reverse eng.) turned OSS maintainer ◦ Mainly around dev tooling: .net, ruby+rails, node, react, react-native, go, hadoop + others. • Building in: Rust, Go • Find me: (github|twitter|medium).com/jondot
3. Teams using secrets: vanilla cloud, say, AWS • Pick KMS • Build some glue code, make sure all services use it • We have to live with some dev overhead
4. Teams using secrets: Heroku (PaaS) w/GitOps • Point and click through your setup • Use .env files, and dotenv • No standard way to work • Can get really messy really quickly
5. Teams using secrets: Kube FTW • Use what the platform gives you: secret stores, + integrate w/vaults ◦ Consul, Vault, others. • Workflow via local CLI tools • Involves integrations/configuration work, but, ok.
6. It’s all fun and games until... Reality hits • Lots of people and different roles • Many use cases • Lots of secrets, settings and different services • “Multi cloud” Problems • No single source of truth, leads to reliability problems, hard to bring up new envs, hard to reason about secrets • End up w/piles of custom scripts, ad-hoc projects, and local settings increases security risk
7. But...but… 12-factor and .env! • Hard to manage when complexity rises (people, services, machines, etc.) • More ways to fuel secret sprawl
8. My wishlist: Productivity & Safety • One tool • With no vendor lock (let me choose my vault) • Supporting all vaults & secret stores in the known universe • Useful for many roles (dev, ops, sec) • Has security as a first-class citizen • Is free and open source
9. • A cute & small CLI (Go) to fetch, manage, and run processes w/secrets • Over 12 different providers • Use from terminal, CI, servers, or as a library • Generates no intermediate files • No data stored on disk • When running processes - no shell env spillover ◦ Nice side effect - no ps sniffing • Least privilege principle by default ◦ Providers auth - delegated ◦ Access - specific by default Secret management hub for developers github.com/spectralops/teller
10. How to start? • Create .teller.conf once, describes sources of truth • Same file for everyone, safe to commit • Essentially: simple key<>provider routing graph • Supports templating & params • Mix many providers types • Or many providers for same type • Opens up many use cases: run, sync, copy, + more. $ brew tap spectralops/tap && brew install teller $ tlr new
11. after before
12. $ tlr run ./my-server
13. $ tlr run ./my-server grab .teller.conf
14. $ tlr run ./my-server grab .teller.conf read the key routing table
15. $ tlr run ./my-server grab .teller.conf read the key routing table connect to providers
16. $ tlr run ./my-server grab .teller.conf read the key routing table connect to providers inject & sanitize process env
17. $ tlr run ./my-server grab .teller.conf read the key routing table connect to providers Inject & sanitize process env run
18. $ tlr run $ tlr scan But actually, there’s much more
19. $ tlr run $ tlr scan $ tlr redact But actually, there’s much more
20. $ tlr run $ tlr scan $ tlr redact $ tlr copy But actually, there’s much more
21. $ tlr run $ tlr scan $ tlr redact $ tlr copy $ tlr drift But actually, there’s much more
22. $ tlr run $ tlr scan $ tlr redact $ tlr copy $ tlr drift $ tlr put But actually, there’s much more
23. $ tlr run $ tlr scan $ tlr redact $ tlr copy $ tlr drift $ tlr put $ tlr sh|json|yaml|... But actually, there’s much more
24. Power combos
25. Workflow example #2
26. What’s next + PRs welcome! • Nice password/key tooling: strength, validation, timing • + 4 providers in the backlog (1pass, lastpass, others) • Have an idea? PRs welcome.
27. Thanks! dotan@spectralops.io https://spectralops.io