Originally reported by Economic Times India (economictimes.indiatimes.com), October 2017.
Overview: CyberArk and Puppet Join Forces on Secrets Management
CyberArk announced a partnership with Puppet, joining as an Advanced Technology Partner under Puppet’s Technology Alliance Partner Program (TAPP). The two companies collaborated to produce supported Puppet modules that bring automated, enterprise-grade secrets management directly into Puppet’s configuration automation workflows. The goal: enable high-velocity DevOps teams to handle secrets securely without stepping outside their existing toolchain.
The Problem: Secrets Sprawl in Dynamic DevOps Environments
Modern DevOps environments are highly dynamic. Tools, scripts, applications, and services are continuously provisioned, updated, and decommissioned. Each of these lifecycle events typically requires secrets — SSH keys, API keys, passwords, and TLS certificates — to function correctly.
In practice, secrets in fast-moving pipelines are often:
- Left unchanged or never rotated after initial provisioning
- Not revoked when the service or node they belong to is retired
- Stored in plain text in configuration files, scripts, or version control
- Unavailable at runtime, causing application failures
Because these credentials grant access to sensitive infrastructure, they are a high-value target for both external attackers and malicious insiders. A single compromised secret can be enough to facilitate a broader, enterprise-wide attack.
CyberArk Conjur: Secrets Management Built for DevOps
CyberArk Conjur is CyberArk’s platform-independent secrets management solution. It is designed specifically for cloud-native and containerized environments, addressing the unique challenges of machine identity and non-human credential management at scale.
Key characteristics of Conjur relevant to DevOps teams include:
- Platform independence: Conjur is not tied to a specific cloud provider or orchestration platform.
- Container-native architecture: Built with containerized workloads in mind, making it suitable for Kubernetes, Docker, and similar environments.
- Flexible deployment: Can be deployed on-premises or in any major cloud environment.
- Machine identity security: Authenticates machines and workloads before granting access to secrets, enforcing least privilege at the node level.
- Minimal integration effort: Designed to integrate with existing development workflows without requiring teams to adopt entirely new tooling or processes.
How the Puppet Integration Works
The CyberArk–Puppet integration delivers secrets management through supported Puppet modules. This allows Puppet users — including those managing Puppet Masters, nodes, and end users — to consume secrets securely without leaving the Puppet interface.
From a workflow perspective, the integration provides:
- Automated secret retrieval: Puppet manifests and modules can retrieve secrets from CyberArk Conjur at runtime, eliminating the need to hard-code credentials.
- Strong machine authentication: Before any secret is delivered to a Puppet node, Conjur authenticates the machine identity, ensuring credentials are only granted to authorised endpoints.
- Least privilege enforcement: Access policies in Conjur restrict which nodes and roles can access which secrets, reducing blast radius if a node is compromised.
- Familiar Puppet interface: Security controls are embedded in the Puppet workflow, so DevOps engineers do not need to context-switch to a separate security tool for day-to-day operations.
“This integration balances security and productivity by allowing Puppet users to continue to work within the familiar Puppet interface to secure and manage secrets used by Puppet Masters, nodes and users. The integrated solution provides security with a strong authentication mechanism for machines before granting secrets, as well as implementing least privilege for nodes.”
— Tim Zonca, Vice President of Business Development, Puppet
Benefits for Security and DevOps Teams
One of the core tensions in DevOps security is the trade-off between development velocity and security controls. Introducing a secrets management layer can create friction if it requires developers to adopt a separate workflow. The CyberArk–Puppet integration attempts to resolve this by embedding secrets management within existing Puppet automation.
For DevOps and platform engineering teams, the integration means:
- Secrets are injected automatically at provisioning time, reducing manual steps and human error
- Pipelines can run at full velocity without secrets being a blocker
- No need to maintain separate secrets distribution scripts or workarounds
For security and compliance teams, the integration provides:
- Centralised visibility and auditability of which machines accessed which secrets
- Consistent application of security and compliance policies across dynamic environments
- Reduced risk of secrets sprawl and orphaned credentials
- No creation of additional, uncontrolled security silos
Technology Partner Programs
As part of the announcement, Puppet joined the CyberArk Global Technology Partner Program, which brings together enterprise software vendors, IT security providers, and managed service providers to build integrated solutions around privileged account security. CyberArk simultaneously joined Puppet’s Technology Alliance Partner Program (TAPP).
These reciprocal partnerships signal a broader industry effort to treat secrets management and privileged access security not as bolt-on features, but as foundational components of the DevOps toolchain.
Key Takeaways
- CyberArk Conjur integrates with Puppet to automate the secure retrieval and management of secrets in configuration automation workflows.
- Secrets — SSH keys, API keys, passwords, certificates — are authenticated and delivered to nodes at runtime, replacing static hard-coded credentials.
- Least privilege and strong machine identity authentication are enforced before secrets are granted.
- The integration is designed to maintain DevOps velocity while satisfying enterprise security and compliance requirements.
- Both companies have joined each other’s technology partner programs, reflecting a mutual commitment to the integration.