Vault integration for app delivery in Spinnaker: best practices & lessons
summary
Built a pipeline-integrated secret injector that mutates deployments to add an init container which fetches secrets into an emptyDir volume, replacing a slower two‑stage flow with a one‑stage custom Spinnaker stage used across multiple OpenShift clusters. Implementations include Vault + init-container via k8s auth requiring cluster-level setup and namespace serviceaccount tokens, and an EKS variant using AWS EKS IAM service-account + KMS/SSM annotations. Sealed Secrets is explored but not deployed; rotation requires sidecar or app awareness.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:39Challenges in Secrets Management
- 3:10Application Use of Secrets
- 5:29Secrets Management Framework - initContainer
- 6:24Secrets Management Framework - Service
- 14:34AWS EKS Secrets Management - Spinnaker Pipeline
- 16:33Secrets Management With Hashicorp Vault
- 16:57Vault Pre-requisites
- 19:20Vault Secrets Management - Spinnaker Pipeline
- 23:01Application Secrets from Git - Spinnaker Pipeline
related talks
30mSecrets Management with Spinnaker
20mEvolving Kubernetes security with Vault and OpenShift
01h 03mSecuring Legacy Applications and Container Microservices in Kubernetes
23mUsing Hashicorp Vault in Kubernetes Clusters
39mManaging and securing Kubernetes secrets - Simon Pearce
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
34mWhich Vault? Don't tell me your secret(s)!
38mKeeping Secrets - A Practical Approach to Managing Credentials