Handling Secrets in Your Cloud Native Architecture
summary
Claims a production pattern that removes runtime coupling to the corporate secret backend by implementing a custom OSB service broker that reads secrets via the backend API (example: Vault) and writes per-app temporary copies into CredHub → credhub-ref paths, returning only the ref to the app. Platform injects secrets into the process environment, avoiding token-expiry and developer-visible credentials. Credential rotation uses a bg restage for automated rotation and rebinding; Garmin reports this approach solves scale, restart, and leak problems.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:28Agenda
- 3:56Vendor Solutions
- 7:09Custom Service Broker
- 8:34Keep Apps Cloud Native
- 9:15Constraint Complexity
- 9:55Service Broker
- 10:40Backend
- 12:39Verify
- 20:47Challenges
- 22:08Credential Lifecycle
related talks
36mCredHub and Secure Credential Management - Peter Blum, Scott Frederick
17mVault and Credhub: Better Together
38mKeeping Secrets - A Practical Approach to Managing Credentials
47mThe Secret to Handling Dynamic Secrets
26mRefactoring Applications for Dynamic Secrets
29mManaging Secrets in Your Cloud Environment
37mUsing CredHub to Increase the Security of Your Platform - Dan Jahner, Pivotal
26mSecret Management in Kubernetes: The GitOps Way - Benjamin Ritter