Chef Vault: A Deep Technical Dive
summary
Explains how Chef Vault creates a single random vault key, encrypts a shared key per user/node using each entity's RSA key pair, and stores per-item keys so authorized workstations and nodes can decrypt secrets; shows knife commands to create, edit, update, refresh and delete vaults and notes needing the chef-vault gem at compile time. Describes Supermarket using separate prod/staging items and keys, warns not compatible with auto-scaling and no access audit logs, and surveys HashiCorp Vault and Citadel as alternatives.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:23Example Infrastructure
- 1:28Security and Usability
- 2:07Preventing Unauthorized Access
- 2:23Enabling Unauthorized Access
- 3:06Understanding Your Environment
- 3:46Overview
- 5:02Encryption
- 7:39Key Rotation
- 7:57What is Chef Vault
- 12:02Creating a Vault
- 14:38Using a Vault in a Cookbook
- 16:08Maintaining a Vault
- 18:20Public Supermarket Example
- 19:09Chef Vault Apps
- 19:49Chef Vault Limits
- 20:54Alternatives
- 22:17Which tool is best
- 23:41Conclusion
related talks
40mA Better Way To Manage Secrets
41mHiding secrets in a Vault
28mHow to Store Secrets—and When Do You Need Them—in HashiCorp Vault
51mIntroduction to Vault
28mSecret Management with Hashicorp´s Vault
29mIntro to secrets management using Vault
48mTurtles All the Way Down: Storing Secrets in the Cloud and the Data Center
43mSecret Management with Hashicorp's Vault