MENU
During a peer review, a developer accidentally committed a YAML manifest containing a plaintext API token, triggering a security alert and raising concerns about the current handling of sensitive values in infrastructure code.
The development team uses an All Apps Organization in VMware Cloud Foundation (VCF) Automation and must adhere to security guidelines while minimizing manual steps in the processes.
Which approach to manage, store, and distribute sensitive data supports secure automation workflows for Supervisor and vSphere Kubernetes Service (VKS) clusters in VCF Automation?
V7.5
Secret Store Service is the purpose-built VCF service for centrally storing, controlling, and distributing sensitive information. It uses OpenBao to protect secrets and supports workloads running directly on Supervisor and within VKS clusters. Kubernetes service accounts authenticate workloads to the service, allowing authorized pods to retrieve or receive secrets dynamically.
The deployment manifest contains a reference to the required secret rather than the plaintext token. This removes sensitive values from Git history, blueprint source, and routine CI/CD output. Access can be restricted according to workload identity and namespace, while secrets can be centrally rotated without editing and recommitting every application manifest.
Secure UI inputs avoid embedding a value in a blueprint but still require manual entry during deployment and do not provide centralized lifecycle management for Supervisor and VKS workloads. Private Git repositories do not make plaintext secret storage safe; repository administrators, compromised credentials, build logs, or historical commits can still expose the values. Environment-variable substitution similarly moves the exposure point into the pipeline rather than eliminating it.
Currently there are no comments in this discussion, be the first to comment!