Using dynamic secrets for third-party Kubernetes applications at scale
summary
Claim: third‑party Kubernetes apps use dynamic secrets with zero code changes by syncing Vault to k8s and triggering rollouts. Implementation uses a custom DataDog Vault secrets engine, the Vault Secrets Operator, and Kubernetes secret injections instead of the CSI provider or side‑car Vault agent. Canva moves from thousands of node keys to tens per cluster, sets DataDog API key TTL at 96 hours, increases the periodic token to 24h to tolerate Vault outages, and runs successfully in production for months.
AI-written summary · about
chapters (7)
- 0:00Canva's vault journey
- 1:52The dynamic secrets challenge
- 4:45Implementing dynamic secrets
- 8:41Injecting into Kubernetes
- 13:57Vault agent injector trial
- 19:51Vault secrets operator
- 26:31Reliability and conclusions
related talks
47mThe Secret to Handling Dynamic Secrets
31mVault and Secret Management in Kubernetes
41mEasy Secrets in Kubernetes: Because I Vault It Well
48mEffortless Secrets Management in Kubernetes
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes
23mVault for Secrets Management and TLS in Consul K8s
20mEvolving Kubernetes security with Vault and OpenShift
34mWhich Vault? Don't tell me your secret(s)!