Central identity and secrets - the foundation of fleet security

Central identity and secrets are the foundation of fleet security. This lesson covers how to design and operate them.

Central identity

Central identity provides:

• Single source of truth: one place where users exist.
• Consistent permissions: same user has same access everywhere.
• Audit trail: who logged in where, when.
• Single sign-on: one credential, many services.

For a Linux fleet:

• FreeIPA: open-source, Linux-native.
• Active Directory: Microsoft, mixed environments.
• Keycloak: open-source, modern, supports SAML/OIDC.

FreeIPA is the natural choice for Linux-only. AD is the default in enterprises. Keycloak is the modern alternative for cloud-native.

Central secrets

Central secrets provide:

• Dynamic secrets: rotate automatically.
• Access control: who can read what.
• Audit: who read what, when.
• Encryption: secrets at rest.

HashiCorp Vault

Vault is the open-source standard for secrets:

# Write a secret - value from stdin (the trailing "-"), never from argv
printf '%s' "$PW" | vault kv put secret/myapp/db password=-

# or from a 0600 file under /run, with the "@" file reference
vault kv put secret/myapp/db password=@/run/secrets/db.pw

# Read
vault kv get -format=json secret/myapp/db

# Dynamic database credentials
vault read database/creds/myapp-readonly

Vault supports:

• KV store (key-value).
• Dynamic secrets (DB, cloud, SSH).
• Encryption as a service.
• PKI (certificates).

AWS Secrets Manager

For AWS-based fleets:

# file:// reference, not an inline literal
aws secretsmanager create-secret --name myapp/db \
    --secret-string file:///run/secrets/db.json

aws secretsmanager get-secret-value --secret-id myapp/db

AWS-native, KMS-integrated. Limited to AWS.

sops + git

For smaller fleets or config-in-git:

# Encrypt a file. --age takes an age RECIPIENT PUBLIC KEY, not a number
sops --encrypt \
     --age age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p \
     --in-place secrets.yaml

# Decrypt
sops --decrypt secrets.yaml

sops encrypts YAML/JSON files in git. Keys are in age or PGP. Good for config-as-code.

How to choose

For most production: Vault or cloud secret manager.

Where to put the secrets backend

The secrets backend must be:

• Highly available: if down, no one can log in.
• Backed up: if lost, every service loses its secrets.
• Audited: every access is logged.
• Replicated: across regions for DR.

Vault HA: Integrated Raft storage or Consul backend. Cloud secret managers: built-in HA.

Common pitfalls

• Secrets in environment variables: log to journald, visible to anyone with read access.
• Secrets in git without encryption: a public repo exposes everything.
• No rotation: leaked secrets stay valid forever.
• No audit: cannot detect misuse.

Knowledge check