secrets-management
Getting a secret to a process without leaving it on disk or in git.
-
External Secrets with Offline JWT Validation When Vault Cannot Reach the Cluster
Vault's default Kubernetes auth method needs to call back into the cluster's API server on every login, which cannot work once Vault and the cluster sit in deliberately isolated networks. Here is how to configure Vault's JWT auth method to validate service-account tokens offline, against a static public key, and wire External Secrets Operator to use it.
-
Breaking the Circular Dependency in GitOps Secret Delivery
A secrets operator deployed through GitOps is the natural way to get credentials onto a cluster without committing them to git, but that operator needs its own credential to reach the secret store, and nothing has delivered that one yet. This works through where the circularity actually breaks, and gives a complete, reproducible bootstrap using a Vault dev server and the External Secrets Operator on a local kind cluster.
-
Runtime Secret Injection with a Vault Agent Sidecar and a Wrapped AppRole
Rendering secrets into config files during a deploy leaves plaintext sitting on disk indefinitely and turns every rotation into a redeploy. This sets up a Vault Agent sidecar that authenticates with a single-use, response-wrapped AppRole secret and renders a live secret into a file an application container reads, verified end to end with a complete docker-compose stack.
-
Vault KV-v2: Why put Silently Wipes Every Sibling Field
vault kv put writes a full new version of a KV-v2 secret, so adding one field with put silently deletes every other field that secret held. This works through why put behaves that way, what patch actually does instead, and gives a verified, runnable sequence — including the one safe way to remove a single field without racing another writer.