SpringOne 2020 Jonathan Regehr: Architect, Garmin

1. Handling Secrets in
Your Cloud-Native
Architecture
Jonathan Regehr | @jonathanregehr
9/2/2020

2. Who Am I?
• 20+ years in IT (I’m not old, really!)
• Platform Architect at Garmin
• Founding member - Tanzu Vanguard
• Dad & Husband

3. The Goal
Secure, robust, and automated
application credential storage
and distribution

4. Our Role
Innovate and Automate

5. Role Specifics
Developer
• Write Software
• Push to Prod!
Platform Operator
• Remove Developer Roadblocks

6. Here is my source code
Run it on the cloud for me
I do not care how
- Onsi Fakhouri

7. The Goal
Secure, robust, and automated
application credential storage
and distribution

8. Alternatives
• Creds in property files
• User-provided services
• Vendor-provided solutions (YMMV)
• Custom service broker

9. The How
Build a Service Broker:
Integrate [your secret backend] with Credhub

12. Keep Apps
Cloud Native
• 12-factor apps
• Service agnostic

13. Constrain
Complexity
Nuances abstracted
by the broker
Full application
life cycle support

14. Open Service
Broker
• Write a Spring Boot App!
• Same code for any OSB API platform
• Loose coupling between app and secrets
• https://www.openservicebrokerapi.org/

15. Broker à
[backend]
• Must have an API
• Example: HashiCorp Vault
• Bonus points: API + CLI

16. Broker à
[backend]
• Plan your layout
• Simplest: follow the TAS
Org/Space/App model
• Consider a separate master space
• Plan for unique & shared secrets

17. Broker à
[backend]
• Trust but verify
• Inspect the bind request
• Use the environment
• TAS: Org/Space/App
• Kube: Namespace

18. Broker à
Credhub
• API: https://credhub-api.cfapps.io/
• Set permissions!!
• Return a Credhub Ref

19. App Environment:
User-Provided Service

20. App Environment:
Vendor Solution

21. The
Result

22. App Environment:
Credhub Broker

23. Challenges
• Debugging Credhub is hard
• Vendor Lock-in
• The best interests of __ may not
be the same as yours

24. The Bigger Picture
Credential Lifecycle Management

25. Credential
Ecosystem
Management System
Automated credential rotation
Credential tracking

26. Thank you for your time!
• The 12-factor app: https://12factor.net/
• OSB API: https://www.openservicebrokerapi.org/
• Vault API: https://www.vaultproject.io/api-docs/
• Credhub API: https://credhub-api.cfapps.io/
• bg-restage: https://plugins.cloudfoundry.org/#bg-restage
• Vanguards: https://tanzu.vmware.com/vanguard
@jonathanregehr
https://www.linkedin.com/in/jonathan-regehr/
https://careers.garmin.com/