using puppet with a secrets server

Using Puppet With A Secrets Server8 October 2015

© 2015 Conjur. All rights reserved. 1

Hi!

© 2015 Conjur. All rights reserved.2

@KingOAuth

Agenda

•Why Deploy a Secrets Server?

• Secrets Management Best Practices

• Puppet & Secrets Walkthrough


WHY DEPLOY A SECRETS SERVER?


Why Deploy A Secrets Server?


Because you need to:• Store• Manage• Distribute

Secrets such as:• SSL Certificates• App/DB Passwords• API Keys• Dynamic Credentials

Core Components of a Secrets Server


• End to End Encryption

• RBAC for People, Machines, and Code

• Self Auditing

• Fully Programmable with Fine Granularity

• Highly Available Across Any Cloud

SECRETS MANAGEMENTBEST PRACTICES


Secrets Management Best Practices


1. Define A Policy

2. Get Your Secrets Into Source Control

3. Create Host Factories

4. Increase Velocity

5. Orchestrate with the DevOps Tool Chain



1. Define A Policy– Policy Defines Security Rules for

the Infrastructure in code.• Which people, machines are

allowed/denied?• Which credentials will they

require?• Which services are allowed to

talk to each other?



2. Get Your Secrets INTO Source Control

– Secrets.yml• http://conjurinc.github.io/summon/–Ability to rotate keys on-demand

http://conjurinc.github.io/summon/



3. Create Host Factories

– A mechanism for “lifting” a new host (machine, container, or PaaS application into a privileged computing role.

– Key component to delivering securely at speed



4. Increase Velocity

– The goal is to deploy to production on-demand, so consider the tool chain as well.

– Frees up the Puppet Master from being a security choke point



5. Orchestrate with the DevOps Tool Chain

mike d. kail

Since this is PuppetConf, probably best to put them above Chef :)

PUPPET & SECRETS WALKTHROUGH


Using Node-Side Secrets With Puppet


* Presented at PuppetCamp Boston, 2014.

Secrets In Manifests


Secrets in hiera


Encrypted hiera entries


Node-Obtained Secrets


Summary


THANK YOU!


www.conjur.net

@ConjurInc

using puppet with a secrets server

Technology