Using Ephemeral Credentials for Deployment
summary
Deploys a small Go app to GKE using Vault, Waypoint and Terraform to generate on-demand credentials that auto-revoke, with dynamic Cloud SQL users created by Vault Dynamic Secrets Engine and a Vault agent sidecar injecting DB creds. Credentials expire after 30 seconds expiry and Waypoint updates a running pod via Waypoint config sync to push a Google Maps key without rebuilding. The demo shows the app requires no Vault code, leases are auditable, and the flow works end to end.
AI-written summary · about
chapters (5)
related talks
23mSimplifying Kubernetes deployment with Terraform for OpenAI
39mTrust, but Sandbox: Securing AI Agents in Kubernetes
27mKeeping Your Agents in Check: Layered Security for Agentic Platforms in Production
19mDon't give your agent the master key
25mWho Let the Agents Out? Securing AI Workflows the Right Way
06mSponsored Keynote: Day-2 Ready: Bringing ag...
33mQ&A with Armon
38mA Novel Approach to Generating Terraform Configurations for Google Cloud Platform