You successfully managed to treat your infrastructure as code. And your application config is kept in version control as well. Wait! What did you do with your DB passwords and API tokens? Secrets need special treatment to fully automate your deployment pipeline. In this talk, I will show you how. Slide deck from my Jazoon TechDays presentation from 7 Sep 2019, recorded here: https://www.youtube.com/watch?v=Ip8eTPj3Jsk

1. Secrets as Code
Johann Gyger
@_jogy_

2. –Hannah Foxwell
„Developers don't care about production.
Ops don't care about shipping new features.
No one cares about security.“

4. –Gregor Hohpe
„Automate everything and make those parts
that can't be automated a self-service.“

5. infrastructure
as code
version control
automated
testing
continuous
integration
continuous
delivery

6. secrets
passwords
API tokens
ssh keys
TLS certificates

7. version
control
Solution 1: protect your version control

8. version
control
Solution 2: use a separate version control
version
control
secretscode

9. Solution 3: encrypt your secrets
version control
secret
secret
Blackbox
git crypt

10. Chicken-or-egg problem with secrets

11. Solution 4: use a tool for secrets

12. IAM 101
identities permissions
auth
mehods
userpass
LDAP
certificate
user
app
machine
AppRole
policies
ACL
RBAC

13. AppRole
https://www.vaultproject.io/guides/identity/authentication.html

14. Demo
# Tab 1
vault version
vault server -dev -dev-root-token-id=root
# Tab 2
export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=root
vault token lookup
--
vault kv put secret/for/my/app my-secret=is-very-secret
vault kv get secret/for/my/app
--
vault auth enable approle
--
vim my-policy.hcl
path "secret/data/for/my/app" {
capabilities = [ "read" ]
}
vault policy write my-policy my-policy.hcl
vault policy read my-policy
--
vault write auth/approle/role/my-approle policies=my-policy
vault read auth/approle/role/my-approle/role-id
vault write -f auth/approle/role/my-approle/secret-id
# Tab 3
export VAULT_ADDR=http://127.0.0.1:8200
vault write auth/approle/login role_id=... secret_id=...
export VAULT_TOKEN=...
vault token lookup
vault kv get secret/for/my/app
vault kv get secret/for/other/app

16. AppRole advanced
https://www.vaultproject.io/guides/identity/authentication.html

17. Vault & K8s
K8s
auth method
SecretsBoostport

18. Security is difficult to automate.
Secrets management can be automated.
Be aware of the chicken-or-egg problem with secrets and how to solve it
with two channels.
Give Vault a try!
Conclusion