A Vault Job

Wed, 21 Oct 2026 13:04:12 +0200

When deploying software services, they usually link to other services using long-lived static credentials (API keys or passwords). For example, a web application and its database, or an LLM provider access token. When the service supports it, those long-lived static credentials can be replaced with short-lived tokens obtained through OIDC-based workload identity federation, with access controlled by RBAC.

I’ve been tinkering a lot with OIDC and RBAC recently because I’m handing over responsibility that can’t be tied to my identity. But before I get there with everything that I run, here’s a writeup of what I’ve been doing in the past year with long-lived static credentials that makes secrets rotation possible.

Managing Secrets privately with sops-nix

Fri, 15 May 2026 02:37:41 +0200

tl;dr ¶

I want to commit my secrets encrypted to git with sops-nix
I want to publish my infra-as-code, but don’t want to publish my git secrets
So I put my secrets in a private git+file flake input

Motivation ¶

I run Kubernetes clusters managed declaratively with Talos Linux and kubenix. I want to publish the entire repository that defines the cluster. It includes commands that require authentication (kubectl, talosctl, hcloud, etc.) that don’t work without their secrets.

Vault on Simon Shine

A Vault Job

Managing Secrets privately with sops-nix

tl;dr ¶

Motivation ¶