Application Credentials Delivery and CI/CD Integration
Domain 5 - Application Credentials Delivery and CI/CD Integration
This domain tests how secrets reach applications and pipelines without being baked into images, repositories, or build logs. Know Summon, Secrets Provider for Kubernetes, SDKs, and CI/CD identity federation.
Core rules and concepts
- Summon reads a secrets.yml file, resolves !var entries through a provider, and injects environment variables or files into a subprocess. The Conjur provider uses variables such as CONJUR_APPLIANCE_URL, CONJUR_ACCOUNT, CONJUR_AUTHN_LOGIN, and either CONJUR_AUTHN_API_KEY or a JWT-based flow.
- Secrets Provider for Kubernetes can run as an init container or CSI driver. It authenticates with authn-jwt or authn-k8s and creates Kubernetes Secrets. Prefer CSI or external secret synchronization over long-lived Kubernetes Secrets where possible.
- CI/CD integration should use OIDC or JWT federation from GitHub Actions, GitLab, Jenkins, or Azure DevOps. Fetch secrets at runtime, mask output, scope policy per pipeline, and keep credentials short-lived.
- Build arguments, image layers, and logs persist secrets. Avoid passing secrets as Docker build args or echoing them in scripts.
- Separate build and deploy identities. A test pipeline should not inherit production execute rights.
Worked example
A GitHub Actions job sets id-token write permission. Conjur authn-jwt trusts the GitHub issuer and audience. Summon runs with the Conjur provider, fetches only the test database password, and injects it into the test process. The job token expires after the run. The reasoning: workload identity replaces a stored secret zero, policy limits the pipeline to one variable, and nothing sensitive is stored in repository secrets.
Traps that cost marks
- Storing a Conjur API key as a CI secret and calling the integration secure.
- Running echo on a secret or enabling shell tracing that prints it.
- Baking secrets into container images or passing them as build arguments.
- Giving a build pipeline execute rights on production variables.
- Assuming masking covers transformed, encoded, or split values.
- Forgetting to clean the workspace and rotate credentials after a failed job.
Governance, Auditing, and Secrets Remediation
Domain 6 - Governance, Auditing, and Secrets Remediation
This domain tests the operating model after deployment: who owns secrets, how access is reviewed, what evidence audit produces, and how discovered secrets are remediated.
Core rules and concepts
- Governance means classifying secrets, assigning owners, defining rotation and revocation service levels, reviewing NHI access, and separating policy authorship from approval.
- Conjur audit records authentication, policy loads, secret retrieval, and permission changes. Forward events to a SIEM. PAM audit covers Vault and Safe activity. Correlate human and machine events during investigations.
- Evidence should answer who or what accessed which secret, when, from where, and with what result. Retain it according to policy and regulatory requirements.
- Remediation is a lifecycle: discover hardcoded or unmanaged secrets, onboard them to the vault, update the consumer, rotate, revoke the old credential, and monitor for recurrence.
- Useful metrics include secrets under management, rotation compliance, orphaned hosts, stale API keys, and host factory token age.
Worked example
A scanner finds an AWS key in a repository. The team creates a prod/aws/deploy variable, permits the CI host execute, updates the pipeline to fetch at runtime, rotates the AWS key, revokes the old key, removes the value from repository history, and adds pre-commit scanning. The reasoning: update the consumer before rotation, revoke after the new path works, then clean history. Audit should show the new host access and the old key revocation.
Traps that cost marks
- Deleting a secret before rotation and breaking the application.
- Auditing only the vault while ignoring retrieval and authentication events.
- Reviewing human access but not NHI access, orphaned hosts, or host factory tokens.
- Treating discovery as remediation when the credential is still valid and exposed.
- Leaving secrets without a named owner or rotation service level.
- Failing to verify that old credentials were revoked, not merely replaced.