Securing Legacy Applications and Container Microservices in Kubernetes
summary
The project uses HashiCorp Vault as the single hardened secret store with two isolated clusters (stage and production) backed by Consul and configured from Ansible playbooks. An internal GitOps enrollment platform integrates with Jenkins to approve requests and push secrets, while automatic mTLS between services, a patched Vault Injector for selective sidecar injection, pgBouncer for Postgres, daily certificate scanning/rotation and one‑day rotation for AD service passwords handle secrets and credential lifecycle. The work was implemented over about two years and is currently running in production.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 4:26Legacy vs cloud security
- 7:52Vault for secrets
- 13:26Internal secrets platform
- 21:41Advanced cert roles
- 27:20Vault Kubernetes Java
- 34:02Dynamic access policies
- 42:33Results and next steps
- 51:54Monitoring scalability
- 53:40Q&A
- 57:16Strategic advice
- 1:01:10Security by design
related talks
31mVault and Secret Management in Kubernetes
23mUsing Hashicorp Vault in Kubernetes Clusters
48mEffortless Secrets Management in Kubernetes
38mKeeping Secrets - A Practical Approach to Managing Credentials
49mManaging Secrets in a Kubernetes Cluster with Hashicorp Vault
23mVault for Secrets Management and TLS in Consul K8s
27mStop the (Password) Insanity! - Managing Credentials with HashiCorp Vault
49mUsing HashiCorp Vault with Kubernetes