MesosCon Europe 2017

Without first class support for secrets (Credentials, API keys etc), application and framework developers had to traditionally resort to out-of-band mechanisms to transmit and use secrets in Mesos. This is changing now!

In this talk, we will describe the newly-added native support for secrets in Mesos. The Secrets API will let Mesos inject sensitive information into either the container environment or sandbox without exposing it to unauthorized actors. The advantage of this approach is that users do not need to explicitly store sensitive information in their task configuration but can let Mesos retrieve it from a secret store at container launch time. This is possible via the new “Secrets Resolver” module interface which allows operators to integrate Mesos with 3rd party secret stores (e.g., HashiCorp’s Vault).

We will show a cool demo at the end that shows secrets in action.