The document discusses managing secrets securely. It covers storing secrets in a secured key-value store with encryption, access controls, and auditing. Dynamic secrets are generated on-demand without stored root passwords. The key-value store supports generic secrets, dynamic secrets, versions, rollbacks, and integrating with systems like AWS, databases, and SSH.

1. Managing secrets
Chris Levi
DevOps Engineer

2. We all have secrets..

3. We all have secrets..
to remember..

4. We all have secrets..
to remember..

5. Keeping secrets is HARD.

8. WHERE is my secrets? WHAT is a secret?
Are they safe?
Are we doing it right?
?WHO can access them?

9. Passwords

10. Certs
Passwords

11. Certs
Passwords API Tokens

12. Certs
Passwords API Tokens
Sensitive data

13. Certs
Passwords API Tokens
Sensitive data

14. Certs
Passwords API Tokens
Sensitive data

15. Storage
secret

16. Storage
secret
Database

17. Storage
Secured
secret

18. Storage
Secured
secret
Ansible-vault

19. Storage
Secured
Manageable
secret

20. Storage
Secured
Manageable
secret
Who? When?
What?

21. Storage
Secured
Manageable
Highly available
secret
secret secret

22. Storage
Secured
Manageable
secret
secret secret
Automate everything!
Highly available

24. Certs
Passwords API Tokens
Sensitive data

25. Certs
Passwords API Tokens
Sensitive data
Secured KV Store
Encryption as a service
Storage backends

26. Key Value
ClearText!?

27. Certs
Passwords API Tokens
Sensitive data
Secured KV Store REST API
Encryption as a service
Storage backends
Active/Standby
UI

28. Certs
Passwords API Tokens
Sensitive data
Secured KV Store
Good PKI
REST API
Encryption as a service
Storage backends
Active/Standby
UI
Dynamic secrets

29. Certs
Passwords API Tokens
Sensitive data
Secured KV Store
Dynamic secrets
Good PKI
ACL Policies
REST API
Auth backends
Audit
Encryption as a service
Storage backends
Active/Standby
UI

30. The Triple AAA
secret
Machine
Operator
Workflow
AuthzAuthn Audit

31. The Triple AAA
Machine
Operator
Authn
Workflow
Login
secret
AuthzAuthn Audit

32. The Triple AAA
Operator
Authn
Login
secret
AuthzAuthn Audit
Token

33. The Triple AAA
Authn
secret
MachineWorkflow
AuthzAuthn Audit

34. The Triple AAA
Authn
secret
Circle of Trust
MachineWorkflow
AuthzAuthn Audit
Tokens Okta
AppRole K8s
TLS Certs GCP
AWS RADIUS

35. The Triple AAA
Authn
Login
secret
Circle of Trust
Injected on
Deploy
MachineWorkflow
/var/run/secrets/kubernetes.io/
serviceaccount/token
AuthzAuthn Audit

36. The Triple AAA
Authn
Login
secret
Circle of Trust
Injected on
Deploy
MachineWorkflow
/var/run/secrets/kubernetes.io/
serviceaccount/token
AuthzAuthn Audit
Token

38. The Triple AAA
Policy
Token
AuthzAuthn
secret
MachineWorkflow
Login
AuthzAuthn Audit
Operator

39. The Triple AAA
Policy
Token
AuthzAuthn
secret
Machine
Operator
Workflow
Login
Audit
Audit

40. secret
Generic secrets
Data encrypted at transit/rest
Path based
KV Versions
Rollback

41. secret
Dynamic secret

42. secret
Dynamic secret
on-demand generated secrets
No root passwords for clients
Unique audit footprints
Strict access for a limited time
Active
Directory
AWS
Databases Azure
OTP GCP
SSH Nomad
Certificates RabbitMQ

43. Request
Credential
Dynamic
Secret Engine
Audit
Create
Credential
Github
k8s
Jenkins
Token

44. Configure AWS dynamic secret

45. Renew, revoke, lease

46. Lease ID
TTL
Secret
secret

47. Lease ID
TTL Renew
Revoke
Secret
secret

48. Token
Policies
Lease ID
TTL
Num Use
Renew
Revoke
Secret
secret

52. Unsealing vault

53. Shamir secret sharing
Data is encrypted in rest
Protect encryption key with Master key
Split master key to N shares
Quorum of N shares is need to unseal
Master Key
Unseal Keys
Encryption Key
Storage backend
Read/Write

54. Vault init

55. Demo