'Static Typing' in Vault
summary
A concrete fix for mismatched S3 creds and other Vault secrets: a command-line tool called vault helper that uses JSON Schema to validate, describe and write KV secrets so Nomad jobs fail less often. It catches wrong paths and keys (e.g., access_key_id vs secret_access_key), supports whole-path and CI validation, offers a shorthand schema language, and the demo shows it catching missing/typed fields. Limitations: requires broad Vault tokens, KV v2 support and migration for existing secrets, and careful handling of revealed key names.
AI-written summary · about
chapters (8)
- 0:00Introduction to unstructured secrets
- 3:57Problems with unstructured secrets
- 7:07Fix one documentation and scripts
- 8:49Fix three static typing for secrets
- 13:29Demo of vault helper tool
- 20:36Challenges and migration
- 22:41Next steps and future plans
- 24:06Recap and conclusion
related talks
30mEfficiently share and manage secrets across applications with HashiCorp Vault
51mIntroduction to Vault
40mA Better Way To Manage Secrets
28mHow to Store Secrets—and When Do You Need Them—in HashiCorp Vault
41mHiding secrets in a Vault
42mDynamic credentials for Kubernetes workloads with Vault and VSO
29mHow to get dynamic with secrets management
38mKeeping Secrets - A Practical Approach to Managing Credentials