Managing Spring Boot Application Secrets
summary
Demos use CyberArk Conjur and an open-source Conjur SDK for Spring Boot to replace hard-coded credentials, authenticate workloads with JWT/Spiffe/certificates, and rotate secrets automatically; patterns implemented include sidecar/init containers, a secrets-provider that updates Kubernetes Secrets or files, a secretless broker proxying MySQL/Postgres/SSH/HTTPS, and Summon for env injection. Presentation cites 12,000 supply-chain attacks in 2021 (≈650% rise) and 45 machine identities per human, and shows kubiscan scanning clusters and zero-downtime rotation via Spring Cloud Kubernetes working end-to-end.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:24CyberArk and secret challenges
- 8:38Application identity security
- 13:36Secret management fundamentals
- 20:27Spring Boot secrets
- 27:40Demo: Spring Boot + CyberArk
- 32:12Kubernetes security patterns
- 39:12Demo: Kubernetes secrets provider
- 43:24Zero-downtime secret rotation
- 47:47Summon and Secretless Broker
- 51:27Key learnings
related talks
42mSpring Vault - managing secrets at scale
53mSecuring Spring Applications with Hashicorp Vault
47mThe Secret to Handling Dynamic Secrets
49m10 Excellent Ways to Secure Your Spring Boot Application
26mRefactoring Applications for Dynamic Secrets
12mManage secrets for apps in Azure Spring Cloud with Key Vault
51mManage Distributed Configuration and Secrets with Spring Cloud and Vault
50mSecrets in Java Services on Spring: Where to Store Them and How to Hot-Reload Them