Everyone is talking about the microservices architecture, and how Docker can help DevOps deploy the services. Docker is often mentioned in conjunction with cluster managers like Kubernates, Marathon or Fleet. But, what about the secrets? The current trend increase the number of secrets required to run our services. This place a new level of maintenance on our security teams. How can we share and manage the secrets(certificates, passwords, keys) for our services in this kind of dynamic scenario; where instances are started automatically, where there are multiple instances of the same services for scalability reasons? Are you keeping up? Come to this session to see how you can manage your secrets with Vault; and make security a first class citizen in the development process.

1. S E C R E T S
A R E
S E C R E T S .
P L E A S E
M A I N T A I N
T H E M
A S
S E C R E T S .

2.  A L E X S O T O B - L O R D O F T H E J A R S . C O M
 alexsotob  lordofthejars

3.  alexsotob  lordofthejars

4. W H O
E N C R Y P T
P A S S W O R D S
I N
R E S O U R C E
F I L E S ?
 alexsotob  lordofthejars

5. <<ResourceResource idid==”myds””myds” typetype==”DataSource””DataSource”>>
JdbcDriver = org.hsqldb.jdbc.JDBCDriver JdbcDriver = org.hsqldb.jdbc.JDBCDriver
JdbcUrl = jdbc:hsqldb:mem:my-datasource JdbcUrl = jdbc:hsqldb:mem:my-datasource
Username = SA Username = SA
Password = SA Password = SA
</</ResourceResource>>
A P A C H E
T O M E E
R E S O U R C E S
 alexsotob  lordofthejars

6. <<ResourceResource idid==”myds””myds” typetype==”DataSource””DataSource”>>
JdbcDriver = org.hsqldb.jdbc.JDBCDriver JdbcDriver = org.hsqldb.jdbc.JDBCDriver
JdbcUrl = jdbc:hsqldb:mem:my-datasource JdbcUrl = jdbc:hsqldb:mem:my-datasource
Username = SA Username = SA
Password = xMH5uM1V9vQzVUv5LG7YLA== Password = xMH5uM1V9vQzVUv5LG7YLA==
PasswordCipher = AES PasswordCipher = AES
</</ResourceResource>>
<<ResourceResource idid==”myresource””myresource” class-nameclass-name==""org.superbiz.VaultGatewayorg.superbiz.VaultGateway"">>
//..... //.....
VaultPassword = cipher:AES:xMH5uM1V9vQzVUv5LG7YLA== VaultPassword = cipher:AES:xMH5uM1V9vQzVUv5LG7YLA==
</</ResourceResource>>
A P A C H E
T O M E E
R E S O U R C E S
 alexsotob  lordofthejars

7. publicpublic AESPasswordCipherAESPasswordCipher(()) {{
thisthis..key key == readKeyFromDiskreadKeyFromDisk(());;
thisthis..secretKey secretKey == newnew SecretKeySpecSecretKeySpec((keykey,, "AES""AES"));;
}}
publicpublic String String decryptdecrypt((charchar[[]] chars chars)) {{
Cipher cipher Cipher cipher == Cipher Cipher..getInstancegetInstance(("AES""AES"));;
cipher cipher..initinit((CipherCipher..DECRYPT_MODEDECRYPT_MODE,, secretKey secretKey));;
byte byte[[]] raw raw == Base64 Base64..getDecodergetDecoder(())..decodedecode((toByteArraytoByteArray((charschars))));;
byte byte[[]] stringBytes stringBytes == cipher cipher..doFinaldoFinal((rawraw));;
String clearText String clearText == newnew StringString((stringBytesstringBytes,, "UTF8""UTF8"));;
returnreturn clearText clearText;;
}}
publicpublic char char[[]] encryptencrypt((String sString s)) {{}}
I M P L E M E N T A T I O N
 alexsotob  lordofthejars

8. C H I C K E N - E G G
P R O B L E M
 alexsotob  lordofthejars

9. M O N O L I T H
A R C H I T E C T U R E
 alexsotob  lordofthejars

10. M I C R O S E R V I C E S
A R C H I T E C T U R E ?
 alexsotob  lordofthejars

11. https://vaultproject.io/
A
T O O L
F O R
M A N A G I N G
S E C R E T S
 alexsotob  lordofthejars

12. V A U L T
F E A T U R E S
Secure
Secret
Storage
 alexsotob  lordofthejars

13. V A U L T
F E A T U R E S
Secure
Secret
Storage
Dynamic
Secrets
 alexsotob  lordofthejars

14. V A U L T
F E A T U R E S
Secure
Secret
Storage
Dynamic
Secrets
Data
Encryption
 alexsotob  lordofthejars

15. V A U L T
F E A T U R E S
Secure
Secret
Storage
Dynamic
Secrets
Data
Encryption
Leasing,
Renewing,
Revocation
 alexsotob  lordofthejars

16. V A U L T
F E A T U R E S
Secure
Secret
Storage
Dynamic
Secrets
Data
Encryption
Leasing,
Renewing,
Revocation
Auditing
 alexsotob  lordofthejars

17. V A U L T
F E A T U R E S
Secure
Secret
Storage
Dynamic
Secrets
Data
Encryption
Leasing,
Renewing,
Revocation
Auditing
ACL
 alexsotob  lordofthejars

18. V A U L T
F E A T U R E S
Secure
Secret
Storage
Dynamic
Secrets
Data
Encryption
Leasing,
Renewing,
Revocation
Auditing
ACL
Multiple
Authentication
Methods
 alexsotob  lordofthejars

19. V A U L T
F E A T U R E S
Secure
Secret
Storage
Dynamic
Secrets
Data
Encryption
Leasing,
Renewing,
Revocation
Auditing
ACL
Multiple
Authentication
Methods
 REST API
 alexsotob  lordofthejars

20. S E C U R E
S E C R E T
S T O R A G E
 alexsotob  lordofthejars

21. L E T ' S
S E E
I N
A C T I O N
 alexsotob  lordofthejars

22. M I C R O S E R V I C E S
A P P R O A C H

23. A P P I D
A U T H

24. A P P
I D
Random
Unique
Chunk
 alexsotob  lordofthejars

25. A P P
I D
Random
Unique
Chunk
Unique
to
Application
(aka
Service)
 alexsotob  lordofthejars

26. A P P
I D
Random
Unique
Chunk
Unique
to
Application
(aka
Service)
Generated
by
Operator
 alexsotob  lordofthejars

27. A P P
I D
Random
Unique
Chunk
Unique
to
Application
(aka
Service)
Generated
by
Operator
Stored
in
Configuration
Management
 alexsotob  lordofthejars

28. U S E R
I D
Intrinsic
Properties
 alexsotob  lordofthejars

29. U S E R
I D
Intrinsic
Properties
Unique
to
Instance
 alexsotob  lordofthejars

30. U S E R
I D
Intrinsic
Properties
Unique
to
Instance
Generated
by
Cloud
Init
Script
 alexsotob  lordofthejars

32. login
E A C H
S E R V I C E
W I T H
T U P L E
{ A P P I D ,
U S E R I D }
 alexsotob  lordofthejars

33. L E T ' S
S E E
I N
A C T I O N
 alexsotob  lordofthejars

34. E X A M P L E
W I T H
D O C K E R

36. L E T ' S
W I N D
D O W N
 alexsotob  lordofthejars

37. V A U L T
I S
A
S E R V I C E
 alexsotob  lordofthejars

38. T H E R E
I S
N O
S I L V E R
B U L L E T

39. Q U E S T I O N S
 alexsotob  lordofthejars

40. 
http://lordofthejars.github.io/vault_devoxx/

asotobu@gmail.com
 alexsotob  lordofthejars