← Back to Labs

Secrets Management Control Plane

Compare a static secret read with a dynamic lease and watch how identity, policy, KMS unwrap, delivery, and revocation reshape the risk.

Static flow: one stored secret version is decrypted and delivered to the workload.

DeployIdentityManagerKMSWorkloadAuditDatabasev12One record in the manager, no plaintext password baked into the image.
Deploy
Manifest references prod/payments/postgres, not a raw password.
Identity
No bootstrap secret is embedded in the workload image.
Manager
Version 12 stored as ciphertext plus metadata and owner tags.
KMS
Wrapping key payments-secrets/v4 protects the data key.
Workload
Pod image starts clean. No DB secret in env at build time.
Audit
Create event recorded for version 12.
Database
Shared application role payments_app exists downstream.
Static versionKeep one authoritative secret record

The deployment only knows the secret path. The actual database password lives once inside the manager as version 12, encrypted at rest under a wrapped data key.

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →