Sep 19 – 23, 2022
Prague, Czech Republic
Europe/Amsterdam timezone

Secret management service for EGI Infrastructure

Sep 20, 2022, 5:30 PM


Lightning Talk 8 mins Security, Trust & Identity Lightning Talks: Security, Trust & Identity


Viet Tran (IISAS)


Applications in EGI Infrastructure may need different secrets (credentials, tokens, passwords, etc.) during deployments and operations. The secrets are often stored as clear texts in configuration files or code repositories that expose security risks. Furthermore, the secrets stored in files are static and difficult to change/rotate. The secret management service for EGI Infrastructure is developed to solve the issues.

The secret management service is designed as follows:

  • Non-intrusion: Operates as a stand-alone service, no extra efforts from site admins to support the service, no additional permissions are needed for users.
  • Simple usage: Authentication via OIDC tokens from EGI Check-in, no extra credentials are required. The service is based on Hashicorp’s Vault which is well-known in industry, with many client tools and libraries.
  • High-availability: Service instances are distributed on different sites, without single point of failure. A generic endpoint is dynamically assigned to a healthy instance via Dynamic DNS service.

At the moment, the service is in public beta testing, full production operation is expected in September 2022.

The service is available at the generic endpoint The detailed designed of the service is available at [1], and user guide is available at [2].



Any relevant links

Service endpoint:
Service design:
User guide:

Topic A Federated Compute Continuum

Primary authors

Presentation materials