This document discusses using HashiCorp Vault for secret management. It provides examples of setting up and testing Vault, including writing and retrieving secrets. It notes that Vault can manage many types of secrets and offers high availability. While Vault helps with secret storage, the bigger challenge is how to integrate it into continuous delivery pipelines and establish trust so apps can securely retrieve secrets from Vault during runtime. More discussion on this topic will come in a future part.

1. DevSecOps SG Meetup -
Jun 29

2. Managing Secrets
Using HashiCorp Vault
DevSecOps SG Meetup - Jun 29
It’s been a while!

3. Hi mate!

4. Great Ocean Road, Victoria, Australia

5. Lake Bellfield - Grampians National Park, Victoria,
Australia

6. Sunrise at Boroka Lookout, Grampians National Park, Victoria, Australia

7. Sunset at Reed Lookout, Grampians National Park, Victoria, Australia

8. TimeLapse Drive - Khao Yai National Park, Thailand

9. Haew Suwat Waterfall - Khao Yai National Park, Thailand

10. https://about.me/fabian.lim
https://tech.gov.sg
@GovTechSG
@3jmaster

11. GovTech Pride Products

12. BeeLineCrowd-sourced Bus Services
MyRespond
erCrowd-source Responders for First Aid
Data.gov.sg
Providing Public Data for Open-Source Projects
Featured on RedHat Summ
Featured on AWS
Summit 2016

13. Interested to
make an
impact?
Join me @ GovTech
https://tech.gov.sg

14. ¯_( ツ )_/¯
Why are we here, again?
¯_( ツ )_/¯ ¯_( ツ )_/¯
¯_( ツ )_/¯
¯_( ツ )_/¯ ¯_( ツ )_/¯
¯_( ツ )_/¯

15. RIGHT!
Remembe
r our
Github workshop
?

16. I think developers are
storing secrets in source
code.
To avoid repeating the
Uber Blunder
I aim to remove secrets
from source code
repositories.
Password
Hunting
https://fabianlim1989.github.io/devsecops-git-workshop/#/password-hunting

17. But WHY would developers
store secrets in code
repositories?
Identifying the root cause is plain simple,
yet implementing the solution is an uphill battle.

18. ¯_( ツ )_/¯ ¯_( ツ )_/¯
¯_( ツ )_/¯
Note: Today is PART 1,
we will be back with more...
¯_( ツ )_/¯ ¯_( ツ )_/¯
¯_( ツ )_/¯

20. A Developer’s Workflow
Gather Feature Requirements
Code
Test New Code with Integration
Check In Code
Drink Beer to Celebrate

21. Code
Tokens required to interact with other APIs
Usernames and Passwords
Keys and Values
A Developer’s Workflow

22. A Developer’s Dilemma
{
"username": "$USERNAME",
"password": "$PASSWORD"
}
/server.conf
{
"username": "admin",
"password": "admin01"
}
/server.conf

23. A Developer’s Dilemma
{
"APItoken": "$APItoken"
}
/server.conf
{
"APItoken": "18be90ef56"
}
/server.conf

24. BUT
HOW???

26. Discussion Time
How would YOU do it?
Google, duh. http://lmgtfy.com/?q=secret+management+tools
What options does one have?

27. Secret Management Tools

28. Secret Management Tools
[HashiCorp | Ansible | Chef] Vault
CyberArk - Conjur
Knox
Thycotic
KeyWhiz
AWS KMS
HSM
Etc...

29. Comparison
http://lmgtfy.com/?q=hashicorp+vault+comparison
Yeah, market research is hard...

30. HashiCorp

31. FEED
ME
NOW!
Feeding an alpacas at Primo Piazza, Khao Yai, Thailand

32. https://www.vaultproject.io/#/demo/0

33. Other Useful Stuffs
Akin to a Swiss Army knife, its
abundant features are useful in
all kinds of situations.
Manage almost ANY secret
Certificate Authority
SSH Key Management
...
High Availability Cluster
Everything is an API call away
Open-Source! Sort of...

35. # SETUP and Test hello world
# export VAULT_ADDR=http://54.255.140.240
# export VAULT_TOKEN=508f84ac-a239-833e-8029-6b26e7a1d834
# curl -X GET -H "X-Vault-Token:$VAULT_TOKEN" $VAULT_ADDR/v1/secret/hello
{"request_id":"98039c27-213c-d901-98c3-
ce4803126ca3","lease_id":"","renewable":false,"lease_duration":2764800,"data":
{"value":"world"},"wrap_info":null,"warnings":null,"auth":null}
On Local Terminal [https://www.vaultproject.io/api/index.html]

36. # WRITE SECRET
# curl -H "X-Vault-Token: $VAULT_TOKEN" -H "Content-Type: application/json" -X
POST -d '{"value":"my name is $USER"}' $VAULT_ADDR/v1/secret/$USER
On Local Terminal [https://www.vaultproject.io/api/index.html]

37. # GET WRAP RESPONSE
# curl -X GET -H "X-Vault-Token:$VAULT_TOKEN" -H "X-Vault-Wrap-TTL:10m"
$VAULT_ADDR/v1/secret/hello
{"request_id":"","lease_id":"","renewable":false,"lease_duration":0,"data":nul
l,"wrap_info":{"token":"c2b0d030-fcc8-8942-e659-
bd978454a9e3","ttl":600,"creation_time":"2017-06-
29T09:27:12.289819346Z"},"warnings":null,"auth":null}
On Local Terminal [https://www.vaultproject.io/api/index.html]

38. # UNWRAP RESPONSE
# curl -X POST -H "X-Vault-Token:$WRAPPED_TOKEN" -H "Content-
Type:application/json" $VAULT_ADDR/v1/sys/wrapping/unwrap
{"request_id":"b36d6da3-ed0a-63ab-b731-
16789815e2c6","lease_id":"","renewable":false,"lease_duration":2764800,"data":
{"vaule":"world"},"wrap_info":null,"warnings":null,"auth":null}
On Local Terminal [https://www.vaultproject.io/api/index.html]

39. The Bigger Picture -
WHERE is the problem?

40. Build
Start -
CODE
IN
Build
Complete -
PRODUCT
OUT
Architecting Trust in CICD Pipeline
Server /
App
Continues
To
Require
Secrets
From
Architecting Trust is not the focus for today, in

41. Server / App
Continues
To
Require
Secrets
From
How does Vault
trust the app?
As an
ephemeral
docker container
/ VM / server?

43. Thanks & Stay Tuned for PART