{"id":16479367,"url":"https://github.com/timebertt/talk-credentials-rotation","last_synced_at":"2026-05-11T21:33:28.610Z","repository":{"id":234078856,"uuid":"611686778","full_name":"timebertt/talk-credentials-rotation","owner":"timebertt","description":"Credentials Rotation in Kubernetes – Putting Together the Puzzle Pieces","archived":false,"fork":false,"pushed_at":"2023-04-16T18:39:59.000Z","size":4747,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-01-11T07:37:16.358Z","etag":null,"topics":["conference","credentials-rotation","kubernetes","security"],"latest_commit_sha":null,"homepage":"https://talks.timebertt.dev/credentials-rotation/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/timebertt.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-03-09T10:40:27.000Z","updated_at":"2023-03-09T11:10:21.000Z","dependencies_parsed_at":"2024-04-18T05:02:48.394Z","dependency_job_id":null,"html_url":"https://github.com/timebertt/talk-credentials-rotation","commit_stats":null,"previous_names":["timebertt/talk-credentials-rotation"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/timebertt%2Ftalk-credentials-rotation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/timebertt%2Ftalk-credentials-rotation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/timebertt%2Ftalk-credentials-rotation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/timebertt%2Ftalk-credentials-rotation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/timebertt","download_url":"https://codeload.github.com/timebertt/talk-credentials-rotation/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241164405,"owners_count":19920570,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["conference","credentials-rotation","kubernetes","security"],"created_at":"2024-10-11T12:51:44.349Z","updated_at":"2026-05-11T21:33:23.571Z","avatar_url":"https://github.com/timebertt.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Credentials Rotation in Kubernetes – Putting Together the Puzzle Pieces\n\n[![Netlify Status](https://api.netlify.com/api/v1/badges/30179840-3ac4-4fcb-940a-7175be505f88/deploy-status)](https://app.netlify.com/sites/talk-credentials-rotation/deploys)\n\nTake me to the [slides](https://talks.timebertt.dev/credentials-rotation/)!\n\n## About\n\nThis is a talk by [@rfranzke](https://github.com/rfranzke) and [@timebertt](https://github.com/timebertt) at [Cloud Native Rejekts 2023](https://cloud-native.rejekts.io/) in Amsterdam ([event schedule](https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-amsterdam-2023/talk/YGEAZF/)).\n\n### Abstract\n\nEvery single Kubernetes cluster brings a plethora of credentials: server certificates, client certificates, ServiceAccount tokens, static tokens, etcd encryption keys, etc. But how do you manage them in a secure way?\nSecurity best practices suggest using short-lived credentials wherever possible and frequently rotating static credentials everywhere else. What does this look like in practice when managing an entire fleet of clusters?\nThis talk puts together the puzzle pieces and presents how one can leverage Kubernetes primitives to securely handle all involved credentials in practice. It summarizes learnings that both cluster administrators and application developers can adopt to provide minimal-ops and disruption-free credentials management in Kubernetes.\n\n### Description\n\nGiven the many distributed components inside a Kubernetes cluster that are connecting to each other, hardening and securing their communication is not as straightforward as one might hope. As a consequence, not every software in the Kubernetes ecosystem is following the best practices for managing credentials.\nThis talk shall inspire the audience on how such best practices (short-lived credentials, auto-rotation) can be implemented to improve the overall security of the ecosystem.\nApart from demystifying credentials management and rotation procedures in general, the listeners get insights into the Kubernetes community's transition from static ServiceAccount token secrets to projected tokens (along with interesting pitfalls).\n\n## Presenting and Editing the Slides\n\nSlides are built in Markdown using [reveal.js](https://revealjs.com/), packaged with [webpack](https://webpack.js.org/), and deployed with [netlify](https://www.netlify.com/).\n\n### Prerequisites\n\nInstall a recent `node` version. Preferably, the one specified in [`.node-version`](./.node-version).\n\n```bash\nbrew install node\n```\n\n### Present Locally\n\nPerform a production build and serve the slides from the `dist` folder:\n\n```bash\nNODE_ENV=production npm run build\nnpm run serve\n```\n\nImportant: Set `NODE_ENV=production` to yield the same build outputs as in production deploys to netlify.\nIf you don't set it, the QR will link to a local IP instead of the canonical URL, for example.\n\n### Edit Locally\n\nRun a dev server with hot-reload and open the slides in the browser:\n\n```bash\nnpm start\n```\n\nAlternatively, use the preconfigured `start` run configuration for JetBrains IDEs.\n\nNow, start editing the [content](./content) files.\nWhen saving, slides are automatically rebuilt and refreshed in the browser.\n\n\u003e Note, that `npm start` doesn't write the output to `dist`.\n\n### Build Locally\n\nRun a full build and write output files to `dist`:\n\n```bash\nnpm run build\n```\n\nNow, output files can be inspected in the `dist` folder.\nAlso, the slides can be served locally from the `dist` folder (no hot-reload):\n\n```bash\nnpm run serve\n```\n\nUsing the above will output non-minimized files.\nSet `NODE_ENV=production` to enable minimization as it is done in netflify builds:\n\n```bash\nNODE_ENV=production npm run build\n```\n\n## Netlify Deploys\n\nNetlify builds and publishes new commits to the `master` branch on https://talk-credentials-rotation.netlify.app/.\n\nhttps://github.com/timebertt/talks contains a [netlify proxy configuration](https://github.com/timebertt/talks/blob/master/netlify.toml) to make the slides available at https://talks.timebertt.dev/credentials-rotation/.\n\nThe netlify site is configured to publish deploy previews for pull requests to the `master` branch and for pushes to arbitrary other branches.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftimebertt%2Ftalk-credentials-rotation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftimebertt%2Ftalk-credentials-rotation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftimebertt%2Ftalk-credentials-rotation/lists"}