4 ms·
The gold standard is to have these tokens be emphermal and have them be issued my something like https://github.com/martinbaillie/vault-plugin-secrets-github ht
by jupp0r 2y ago
The gold standard is to have these tokens be emphermal and have them be issued my something like https://github.com/martinbaillie/vault-plugin-secrets-github https://github.com/martinbaillie/vault-plugin-secrets-github. You should never rely on manually rotating tokens, it's 2024 and we have decades of production outages due to expired certs to prove that this stuff needs to be automated. Having mandatory expiration is a great way to incentivize users to do the right thing here.
- candiddevmike 2y agoIMO, the right way is for GitHub to allow for JWT/OIDC federation, ideally allowing custom public keys to be uploaded, so I can issue my own tokens from a secure crypto source. With the GitHub app, you're still copying/pasting long lived tokens during the setup phase.
- simonw 2y agoIf I want my random DigitalOcean VPS to have access to an account elsewhere, it's going to need a secret of some sort. If it gets issued ephemeral secrets from something like Vault it still needs to be able to identify itself to Vault as "I'm DigitalOcean VPS ID=32443 and I need a 1 hour secret to access this GitHub repo". Eventually, something needs to have a non-expiring secret to help identify it. The more complicated we make this stuff the more chance someone will make a mistake in configuring it and open themselves up to a breach.
- zshev 2y agoI’m not familiar with DO but one approach to the secret zero thing that works elsewhere is the VPS gets assigned an OIDC identity by the provider (or the VPS has access to one if it asks). That identity is in turn used to sign in to Vault.