tag: Secrets-Management · 13 items
- Platform/SRE — Plan: GitLab Secrets Manager is now GA in 19.5 Premium/Ultimate, built on OpenBao — evaluate whether it can replace a standalone Vault deployment for GitLab-centric orgs, since it reuses the existing GitLab permission model and eliminates the sync-drift problem between vault access and project membership.
- CI/CD — Plan: Now GA in GitLab 19.5 — schedule evaluation of Secrets Manager as a replacement for unscoped CI/CD variables; it scopes credentials to individual jobs and attaches pipeline and job IDs to every credential read, making this a concrete supply-chain hardening step for GitLab-hosted pipelines.
- Leader — Learn: For orgs standardized on GitLab, this GA release shifts the build-vs-buy calculus on maintaining a separate secrets vault; no urgent vendor or licensing decision, but worth tracking as a potential toolchain consolidation as the feature matures on Dedicated.
- Signals: GitLab 19.5 EOL 2027-01-21 · GA announcement
- Platform/SRE — Plan: If you run Transfer Family SFTP servers, evaluate migrating host keys to Secrets Manager this quarter to simplify cross-region failover and server migrations without requiring clients to re-trust new host keys.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA capability worth evaluating this quarter for any workloads using Databricks or Twilio: eliminates custom rotation Lambda functions and ensures applications pick up rotated credentials automatically without code changes.
- CI/CD — Learn: Relevant if pipelines consume Databricks personal access tokens or Twilio API keys, but there is no deadline or pipeline breakage — file as a pattern to consider when next reviewing how build credentials are rotated.
- Leader — Skip
- Platform/SRE — Plan: If you run Azure Arc-enabled Kubernetes clusters, plan migration from the Azure Key Vault Secrets Provider Extension to the Azure Key Vault Secret Store Extension before the hard retirement date of October 9, 2027. One year is enough runway to schedule the migration, but start scoping which clusters are affected now.
- CI/CD — Skip
- Leader — Plan: Azure is retiring a secrets-integration extension for Arc-enabled Kubernetes with a clear replacement in the same ecosystem; ensure teams using Arc clusters have this migration on their roadmap before October 9, 2027, as there is no stay-on-current option beyond that date.
- Signals: deprecation/EOL deadline mentioned: October 9, 2027
- Platform/SRE — Plan: A new GA feature in Secrets Manager surfaces rotation gaps and encryption-key misconfigurations directly in the console at no extra cost; schedule a pass through your secrets inventory this quarter to act on flagged items before they become findings in a security review.
- CI/CD — Learn: Console-based recommendations don’t change how pipelines execute, but the rotation and key-management nudges are relevant context for teams auditing how pipeline secrets are stored in Secrets Manager.
- Leader — Learn: A free capability improvement to an existing standard-stack service; no pricing, licensing, or vendor-risk decision required, but worth noting as reinforcement for a secrets-rotation policy or security posture standard.
- Platform/SRE — Learn: Practical integration guide for OpenBao (the Linux Foundation Vault fork) backed by a self-healing CloudNativePG instance — worth evaluating as a vendor-lock-in-free secrets management pattern, but no deadline or operational trigger to act on now.
- CI/CD — Skip
- Leader — Learn: Illustrates a viable open-source secrets management stack (OpenBao + CloudNativePG) that avoids HashiCorp vendor lock-in — useful context if the org is reassessing its Vault strategy, but this is a tutorial with no new strategic event attached.
- Platform/SRE — Plan: If your org runs Vault Enterprise and is deploying AI agent workloads, this GA feature adds purpose-built IAM controls worth evaluating this quarter; no forced migration or deadline, but assess whether your current Vault version and license tier expose it.
- CI/CD — Skip
- Leader — Learn: This signals Vault Enterprise is extending its security model to cover AI agent identities; worth noting if AI agent adoption is on the roadmap and the org is already standardized on Vault Enterprise, but no strategy or contract decision is required now.
- Signals: GA announcement
- Platform/SRE — Learn: Interesting pattern for zero-trust mainframe access using Boundary workers, but no deadline or GA capability change — worth evaluating if mainframes are in scope for the platform.
- CI/CD — Skip
- Leader — Skip
Plan
archived
AWS Secrets Manager adds native rotation for Cisco Security Platform and Netskope tokens
- Platform/SRE — Plan: If your platform integrates Cisco Security Cloud Control or Netskope, you can now remove any custom Lambda rotation logic and let Secrets Manager handle scheduled credential rotation natively; worth scheduling a migration this quarter for affected integrations.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New GA capability for automating credential rotation without custom code; worth knowing for teams already using Secrets Manager managed external secrets, but no operational urgency.
- CI/CD — Plan: Teams using Jenkins or SonarQube with AWS Secrets Manager can now automate token rotation natively — schedule evaluation and adoption to reduce manual credential lifecycle work and lower the risk of stale tokens in pipelines.
- Leader — Skip
- Platform/SRE — Plan: This GA expansion lets platform teams consolidate Kubernetes (ESO), Terraform/OpenTofu, and Vault CLI secrets into a single OpenBao-backed store — worth evaluating this quarter as a replacement for fragmented per-tool secret stores, with no forcing deadline yet.
- CI/CD — Learn: GitLab CI/CD secret support landed in v19.0 already; the new ESO and Terraform integrations are primarily platform-side — no pipeline changes required today, but the unified API surface is worth noting for future supply-chain design.
- Leader — Learn: The consolidated single-store model (one audit trail, one access model across Kubernetes, IaC, and pipelines) is worth tracking as a vendor-consolidation data point when revisiting secrets-toolchain standards, but no pricing or license forcing function exists yet.
- Platform/SRE — Skip
- CI/CD — Learn: Vendor-authored post highlighting how AI coding agents can leak credentials into build/deploy contexts; worth evaluating your secret isolation controls if agents touch pipelines, but no concrete deadline or confirmed compromise here.
- Leader — Learn: Surfaces a real risk category—AI agent access to secrets in the software supply chain—worth factoring into your AI tooling policy and golden-path standards, though this is Docker marketing with no specific incident or actionable deadline.
- Platform/SRE — Plan: New GA capability removes the CloudTrail-parsing workaround for secret rotation events; evaluate adding EventBridge rules this quarter to auto-refresh credential caches or trigger service restarts on rotation, reducing the lag window between rotation and downstream adoption.
- CI/CD — Learn: Could inform future pipeline designs that need to react to secret rotation (e.g., invalidating cached build credentials), but no current pipeline change is required and no deprecation is introduced.
- Leader — Skip