Configuring a More Secure BOSH [I]
summary
BOSH adds a variable system plus a config server API so manifests can omit plaintext SSH keys, passwords and certs; values either come from CLI via -V or are generated and stored (including shared names beginning with a slash) in a vars block or a local var-store creds file. The reference config server and the recommended credhub backend support certificate chaining, versioned variables and runtime lookup; CF‑UAA is used to query variables, and this is running in production on Pivotal.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:42Current security problems
- 2:26Solution with variables
- 5:13Setting up the system
- 7:40Variable types and certificates
- 9:51Integration with other systems
- 12:23Demo introduction
- 13:31Exploring BOSH deployment
- 17:45Using creds.yml and interpolate
- 19:21Accessing the jump box
- 21:43Interacting with Config Server
- 25:49Q&A
related talks
27mBosh Vault: Secretless Bosh Manifests and Vault
37mUsing CredHub to Increase the Security of Your Platform - Dan Jahner, Pivotal
33mBosh Vault: Secretless Bosh Manifests and Vault
30mStreamlining the BOSH Experience
25mBOSH: The Simple Solution for Complex Systems
21mBOSH 2.0: The Evolution
22mEnsuring Platform Security with Windows Bosh Add-ons - Maris, Schaefbauer, Coppock, Boeing
36mCredHub and Secure Credential Management - Peter Blum, Scott Frederick