Refactoring Applications for Dynamic Secrets
summary
Shows a concrete path to rotate credentials without full downtime: a Java Spring Boot app progressively refactors from env/file injection to an SDK approach (demo of code breaks) then to a working Vault agent that templates secrets to files and triggers reloads. Key patterns are using Spring Cloud Vault or an agent plus an API refresh scope endpoint, handling connection tear down, and avoiding mass find‑and‑replace across hundreds of apps. Numbers mentioned: 30‑day rotation and daily rotations.
AI-written summary · about
chapters (9)
- 0:00Refactoring for dynamic secrets
- 2:03Environment variables vs file-based secret injection
- 3:47Secret rotation challenges
- 5:55Automatic secret reload
- 6:58Java SDK auto-reload
- 13:14Agent-based secret management
- 18:50Reloads with agents
- 20:35Hybrid reload approach
- 24:47Is auto-reload worth it
related talks
47mThe Secret to Handling Dynamic Secrets
41mChanging Applications for Changing Secrets
30mLong Live Short Lived Credentials - Auto-rotating Secrets At Scale
29mHow to get dynamic with secrets management
42mSpring Vault - managing secrets at scale
25mHandling Secrets in Your Cloud Native Architecture
36mManage Distributed Secrets in Applications on Cloud Foundry With Spring Cloud Vault
50mSecrets in Java Services on Spring: Where to Store Them and How to Hot-Reload Them