Using HashiCorp Vault with Google's Serverless Solutions
summary
New York Times engineers build and open-source a small Go library called gcp-vault that actually logs into Vault from Google App Engine and Cloud Functions by exchanging Google IAM JWTs for Vault tokens, and it works in production. Access is provisioned via Terraform and an internal tool (Goblin) that maps GitHub personal access token identity to Vault policies; GCP setup grants minimal permissions including serviceAccountTokenCreator, iam.serviceAccounts.get and serviceAccountKeys.get so serverless apps can fetch secrets at startup.
AI-written summary · about
chapters (14)
- 0:00Introduction and speaker background
- 1:08What is serverless and Vault basics
- 3:21Why New York Times uses Vault
- 6:29Onboarding developers to Vault
- 9:22Setting up Google Cloud access
- 12:33Terraform and Goblin workflow
- 16:28Automating secret management
- 17:10Development workflow with Vault
- 19:00Introducing GCP Vault tool
- 20:26Cloud Functions example
- 23:39App Engine integration
- 25:04Local development setup
- 27:17Deployment and summary
- 27:39Q&A session
related talks
28mServerless Secrets with HashiCorp Vault
20mVault Automation with the HashiCorp Stack in OneMount
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
23mFully SaaS-Based DevOps with Terraform Cloud and GitLab
49mUsing HashiCorp Vault with Kubernetes
23mManaging Vault with Terraform
44mSecret Management with Hashicorp's Vault
29mHow to get dynamic with secrets management