Zero-Knowledge Architecture, or Leak-Free Secrets, with HC Vault
summary
Demonstrates an architecture using HashiCorp Vault so an orchestrator can deploy to AWS/Azure/GCP without ever holding root keys. Uses dynamic cloud credentials (per-request), database credential rotation via the database secret engine, short‑lived Vault tokens governed by fine‑grained ACLs, and a Shamir unseal quorum (e.g., 3-of-5) for bootstrap; logging/audit trails provide centralized visibility while each client hosts their Vault in production, with operational complexity focused on bootstrapping and policy design.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:23Zero-knowledge basics
- 5:49HC Vault centralized approach
- 7:16Security abstractions
- 10:07HC Vault features
- 14:16Secret storage backends
- 16:21Cloud provider secrets
- 17:50Kubernetes DB secrets engine
- 19:13Transit encryption service
- 21:17Integrated CA in HC Vault
- 22:23Square use case with HC Vault
- 27:38Bootstrapping master keys
- 31:05Security policy definition
- 34:34Implementation challenges
- 36:22Monitoring and auditing
- 38:06Summary
- 39:31Q&A
related talks
45mZero-knowledge Architecture, or Leak-free Secrets, with HC Vault
42mZero Trust security with HashiCorp Vault and AWS (PRT239)
31mSecure Your Multi-Cloud Delivery Pipeline with HashiCorp Vault
43mSecret Management with Hashicorp's Vault
44mSecret Management with Hashicorp's Vault
38mKeeping Secrets - A Practical Approach to Managing Credentials
41mHiding secrets in a Vault
30mEfficiently share and manage secrets across applications with HashiCorp Vault