# Vault Published articles for Vault. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Grab's LLM-Kit Framework Standardizes More Than 500 Internal Agent Services DevFeed: [Grab's LLM-Kit Framework Standardizes More Than 500 Internal Agent Services]() Original publisher: [Read original article]() Author: Hien Luu Published: 2026-09-15T09:00:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Framework](), [AI Agent](), [Deployment](), [Model Context Protocol](), [agent observability](), [FastAPI](), [OpenTelemetry](), [GitLab]() Tags: [agent](), [agents](), [ai](), [ai-agent](), [ai-ml-data-engineering](), [deployment](), [fastapi](), [framework](), [gitlab](), [grab-agent-platform](), [ml-data-engineering](), [model-context-protocol](), [news](), [opentelemetry](), [vault]() ### AI overview Grab's internal LLM-Kit framework standardizes more than 500 agent services by providing shared scaffolding for evaluation, tracing, secret handling, service discovery, and tool-server connections. The article reports that deploying a new agent service now takes about one hour instead of two weeks or more. ### Source excerpt Grab has implemented LLM-Kit, a framework that standardizes over 500 internal agent services. This system enhances service integration, evaluation, and secret handling, reducing the time to deploy new AI agents from two weeks to one hour. It centralizes infrastructure management, allowing runtime tool discovery and flexible model integration, while maintaining operational control. By Hien Luu ## Multi-tenant OAuth requires credential lifecycle management beyond token isolation DevFeed: [Multi-tenant OAuth requires credential lifecycle management beyond token isolation]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-27T00:00:00Z Content type: opinion Language: en Sources: [WorkOS Blog]() Topics: [OAuth](), [Encryption](), [Authorization]() Tags: [architecture](), [encryption](), [iam](), [lifecycle](), [oauth](), [rotation](), [storage](), [vault]() ### AI overview The article argues that token isolation and storage architecture are only the starting point for multi-tenant OAuth. The harder, ongoing problems include refresh races, key rotation, provider-wide revocations, token expiration, and external revocations without webhooks. It also explains how envelope encryption and per-tenant key contexts can support bridge-style isolation. ### Source excerpt Storage architecture is the half you can finish. The refresh loop, key rotation, and revocation are the half that never does. ## SecretSpec 0.18: Secret lifecycle, four new providers, and Swift DevFeed: [SecretSpec 0.18: Secret lifecycle, four new providers, and Swift]() Original publisher: [Read original article]() Author: domenkozar Published: 2026-08-04T15:41:38Z Content type: release Language: en Sources: [Announcements - NixOS Discourse]() Topics: [Swift](), [SDKs](), [Amazon Web Services](), [Command-line interface](), [Authentication]() Tags: [announcements](), [aws](), [cli](), [import](), [release](), [sdk](), [secrets](), [swift](), [vault]() ### AI overview SecretSpec 0.18 expands secret lifecycle operations, adds four providers, and introduces a Swift SDK. It also adds declaration discovery from additional stores, provider migration safeguards, and several authentication and platform updates. ### Source excerpt 0.18 release expands the secret lifecycle, adds four providers, and introduces a Swift SDK. We have a new logo! Declare, delete, and safely move secrets Declare secrets without hand-editing the manifest: $ secretspec add STRIPE_API_KEY --description "Stripe API access token" ✓ Added secret 'STRIPE_API_KEY' to profile 'default' in secretspec.toml secretspec add preserves the manifest's comments and formatting without asking for or storing a value. secretspec delete removes stored values while keeping their declarations. Provider migrations can remove the source after proving the move succeeded: secretspec import dotenv:~/.config/payments/.env --delete-source SecretSpec verifies each destination value before deleting its source and leaves the source intact when conflicts occur. Discover declarations from existing stores secretspec init --from can now discover declarations from age files, AWS Parameter Store hierarchies, and scoped Bitwarden collections, in addition to dotenv. It writes names and generated descriptions to secretspec.toml, never values. Four new providers SecretSpec now supports 24 providers, including: Bitwarden Password Manager (bw://): read, write, and discover vault items through the bw CLI. Keeper Secrets Manager (keeper://): batched reads, writes, deletion, and existing-record references. AWS Parameter Store (awsps://): KMS-encrypted parameters, versioned references, and bounded discovery. Dashlane (dashlane://): read-only secrets, secure notes, and logins through dcli. Swift SDK and provider authentication The new Swift SDK brings the shared SecretSpec resolver to macOS 12+ on Intel and Apple silicon as a checksummed XCFramework. Vault and OpenBao also gain custom AppRole and JWT mount paths, dotenv paths accept ~, and Linux keyring builds no longer require system libdbus. Read the full announcement: SecretSpec SecretSpec 0.18: Secret lifecycle, Bitwarden, Keeper, AWS Parameter Store,... Declare, discover, migrate, and delete secrets from the CLI ## Managing Environment Variables and Secrets in DevOps DevFeed: [Managing Environment Variables and Secrets in DevOps]() Original publisher: [Read original article]() Author: Pramodh Kumar M Published: 2026-08-01T13:00:47Z Content type: tutorial Language: en Sources: [Kubernetes - KodeKloud Blog | DevOps, Cloud, Kubernetes, AI Tutorials & More]() Topics: [DevOps](), [configuration](), [GitGuardian](), [GitHub](), [Terraform](), [Kubernetes]() Tags: [ci-cd-secrets-management](), [cloud](), [collaboration](), [collaboration-tools](), [configuration](), [container](), [crash](), [devops](), [devsecops](), [dynamic-secrets](), [env-file-security](), [environment-variables](), [gitguardian](), [github](), [hardcoded-credentials](), [hashicorp-vault](), [jira](), [kubernetes](), [kubernetes-secrets](), [leak](), [managing-environment-variables-and-secrets](), [rotation](), [safety](), [sealed-secrets](), [secret-rotation](), [secret-scanning](), [secrets](), [secrets-management-best-practices](), [security](), [storage](), [terraform](), [vault]() ### AI overview A guide to managing environment variables and secrets in DevOps. It explains how secrets escape through repositories, processes, crash reports, containers, collaboration tools, Kubernetes Secrets, and Terraform state, and discusses storage, access controls, lifecycles, and rotation. ### Source excerpt Nearly 29 million secrets were pushed to public GitHub in a single year, and most teams still discover their own leaks by accident. Here is how environment variables actually escape, and what to use instead at each stage. ## A 1Password Runtime for Local Agents and Desktop Apps DevFeed: [A 1Password Runtime for Local Agents and Desktop Apps]() Original publisher: [Read original article]() Published: 2026-06-24T08:00:00Z Content type: opinion Language: en Sources: [Antonio Leiva]() Topics: [API keys](), [Automation](), [App](), [Command-line interface]() Tags: [agents](), [ai](), [desktop](), [development](), [env-file-security](), [secrets](), [security](), [shell](), [vault]() ### AI overview The author describes using 1Password as a runtime for local agents and desktop apps. The proposed setup stores references rather than secret values in an environment file, resolves credentials through a wrapper, and limits the service account's access so child processes receive only the variables they need. ### Source excerpt Everything Android, Kotlin and other random topics ## Automatizar servidores con Ansible: primeros pasos DevFeed: [Automatizar servidores con Ansible: primeros pasos]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-01-08T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [Ansible](), [Ansible Roles](), [ssh](), [dry-run](), [Git](), [nginx]() Tags: [ansible](), [dry-run](), [git](), [nginx](), [ssh](), [sysadmins](), [variables](), [vault]() ### AI overview A step-by-step introduction to automating server configuration with Ansible. It covers ad-hoc commands, inventories, playbooks, dry runs, roles, group variables, loops, and secrets with ansible-vault. ### Source excerpt Ansible desde cero: comandos ad-hoc, playbooks, roles, variables por grupo, bucles y secretos con ansible-vault, paso a paso. ## exploits.club Weekly(ish) Newsletter 93 - Old QEMU Bugs, Android Auto Bluetooth PoCs, BeeStation P20, and More DevFeed: [exploits.club Weekly(ish) Newsletter 93 - Old QEMU Bugs, Android Auto Bluetooth PoCs, BeeStation P20, and More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-12-11T16:24:59Z Content type: article Language: en Sources: [exploits.club]() Topics: [qemu](), [Exploit](), [vulnerability](), [Synology](), [Hardware](), [HTTP](), [container]() Tags: [bugs](), [exploit](), [exploits](), [firmware](), [hardware](), [newsletter](), [qemu](), [synology](), [vault](), [vulnerability](), [weekly]() ### AI overview This issue of the exploits.club Weekly(ish) Newsletter rounds up security write-ups and resources, including a QEMU privilege-level bug that can enable arbitrary writes, a Synology BeeStation exploit involving a stack-based buffer overflow, and research into the Cypherock X1 Vault hardware wallet. The supplied text ends before the final item is complete. ### Source excerpt Welcome back to your favorite "mostly weekly but sometimes whenever we feel like it" newsletter. Annnnnnyways 👇 In Case You Missed It... HEXACON Videos Are OUT Advent Of Pwn - PwnCollege's Advent Of Pwn ends today. If you haven't already given it a go, make ## Zero Standing Privileges vs Credential Vaulting DevFeed: [Zero Standing Privileges vs Credential Vaulting]() Original publisher: [Read original article]() Author: jpitts@goteleport.com (Jack Pitts) Published: 2025-10-28T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Zero Trust](), [Security](), [legacy](), [passwords](), [ssh](), [API]() Tags: [api](), [legacy](), [password](), [rotation](), [secrets](), [security](), [ssh](), [vault](), [vulnerability](), [zero-trust]() ### AI overview This article compares credential vaulting with vault-free, just-in-time and identity-based approaches to privileged access management. It examines how stored and reusable credentials may preserve standing privileges and create operational and security challenges when organizations pursue Zero Standing Privileges. ### Source excerpt Discover how Zero Standing Privileges (ZSP) compares to credential vaulting in privileged access management and why vault-free PAM is key to true ZSP. ## Executing Dynamic JavaScript Code on Supabase with Edge Functions DevFeed: [Executing Dynamic JavaScript Code on Supabase with Edge Functions]() Original publisher: [Read original article]() Author: Rodrigo Mansueli Published: 2024-11-13T07:00:00Z Content type: tutorial Language: en Sources: [Supabase Blog]() Topics: [Supabase](), [JavaScript](), [Serverless](), [Command-line interface](), [Security](), [SQL](), [API]() Tags: [api](), [cli](), [environment-variables](), [how-to](), [javascript](), [security](), [serverless](), [sql](), [vault]() ### AI overview A tutorial on executing dynamic JavaScript in Supabase Edge Functions. It explains how dynamic code execution can change business logic without redeploying the function and introduces helper functions for HTTP requests, JavaScript execution, and retrieving secrets from Vault. ### Source excerpt Learn how to execute dynamic JavaScript code on Supabase using Edge Functions. ## Secure your terraform.state file with Terraform Vault Backend DevFeed: [Secure your terraform.state file with Terraform Vault Backend]() Original publisher: [Read original article]() Author: Zalan Blenessy Published: 2024-10-29T08:45:07Z Content type: tutorial Language: en Sources: [Volvo Cars Engineering - Medium]() Topics: [Terraform](), [HashiCorp Vault](), [Amazon S3](), [DevOps](), [HTTP](), [CI/CD]() Tags: [automotive-industry](), [aws-s3](), [backend-development](), [ci-cd](), [devops](), [hashicorp-vault](), [http](), [s3](), [security](), [software-development](), [terraform](), [vault]() ### AI overview This article introduces the Terraform Vault Backend, a specialized Terraform HTTP backend for storing terraform.state files in HashiCorp Vault. It explains why shared remote state is needed, how Terraform state works, and why state files containing secrets may require more secure storage than ordinary blob stores such as AWS S3. ### Source excerpt tl;dr: The Terraform Vault Backend is the missing complement to the Terraform Vault Provider. Volvo Cars has since 2017 strategically grown its software engineering organisation. Today, we have thousands of software engineers and hundreds of DevOps engineers to facilitate efficient tooling and workflows for software development and release. In my role as a CI Architect at the Complete Software Factory (CSwF) department, I am accountable for the CI/CD systems at CSwF. Most of our services are hosted in "the Cloud" and terraform is the most popular tool used by our DevOps engineers to provision Cloud infrastructure. This article introduces the Terraform Vault Backend, a specialised Terraform HTTP Backend which allows you to store your terraform.state file in HashiCorp Vault. This is relevant if your terraform.state contains secrets, too sensitive to be stored in ordinary blob stores like AWS S3. Terraform is a tool that generates infrastructure from code. Given some configuration, running terraform apply makes Terraform intelligently carry out the actions needed to create the desired infrastructure. For example, you can put the following configuration in main.tf: resource "local_file" "somefile" { content = "foo bar baz" filename = "${path.module}/somefile.txt" } Then apply it with: $ terraform init $ terraform apply Out comes a file called somefile.txt with the content foo bar baz. You can inspect it with: $ cat somefile.txt foo bar baz It also creates a bunch of other files in your folder, most notably the terraform.state file. This file reflects the current state of the "infrastructure" (somefile.txt), which has been provisioned for you. Terraform is idempotent, which means that running terraform apply a second time, with the same input configuration, will not change anything as somefile.txt has already been added to terraform.state . Sharing Terraform State It is not enough to share your Terraform configuration files with your colleagues, you also need to share th ## Keycloak 24.0.4 released DevFeed: [Keycloak 24.0.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-05-08T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [API](), [upgrade](), [Quarkus](), [LDAP](), [container](), [like](), [OpenID connect (OIDC)](), [saml]() Tags: [api](), [container](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso](), [vault]() ### AI overview Keycloak 24.0.4 is released. The update removes support for partial user-attribute updates through the Admin User API, upgrades Quarkus to 3.8.4, and includes enhancements and bug fixes across administration, import/export, LDAP, OIDC, SAML, and related components. ### Source excerpt To download the release go to Keycloak downloads. Highlights Partial update to user attributes when updating users through the Admin User API is no longer supported When updating user attributes through the Admin User API, you cannot execute partial updates when updating the user attributes, including the root attributes like username, email, firstName, and lastName. For more details, see the Upgrading Guide. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #27508 Use new remote-store options in HA guides #28429 Add details to error messages, especially around refresh tokens #28729 Emphasize the need for setting container limit docs #28880 Upgrade to Quarkus 3.8.4 dist/quarkus #29183 Minor corrections to High Availability Guide docs Bugs #16345 Unable to delete realm names with invalid URL characters admin/api #22617 kc export fails when using User Federation (LDAP) with file-based Vault enabled import-export #24568 iframe for frontend logout gets blocked if a custom CSP header is used core #24878 NoClassDefFoundError for Apache XML and EAP8 adapter/jee-saml #27021 Workflow failure: Fuse adapter tests ci #27080 Workflow failure: Operator CI - KeycloakTruststoresTests#testTrustroreExists ci #27514 Uncaught server error: java.lang.IllegalArgumentException: Path parameter not provided oidc #28079 Group search does not work in user view admin/ui #28187 Admin UI drag & drop in flow config seems to delete actions admin/ui #28220 Admin API: User PUT operation clears firstname, lastname email fields admin/api #28303 WARN - Event object wasn't available in remote cache after event was received infinispan #28377 Broken lists in import/export server guide docs #28431 Dedicated client scopes always show up when searching admin/ui #28514 Message for searchClientRegistration is missing admin/ui #28666 Accessing a transient (lightweight) user through client session fails in admin-api/-ui admin/ui #28684 "Exten ## Update for Chainguard Images users on HashiCorp license changes DevFeed: [Update for Chainguard Images users on HashiCorp license changes]() Original publisher: [Read original article]() Published: 2023-09-01T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [chainguard](), [Security](), [Open Source](), [Terraform]() Tags: [chainguard-images](), [consul](), [hardened-container-image](), [hashicorp](), [open-source](), [opentf](), [releases](), [security](), [terraform](), [vault]() ### AI overview Chainguard explains how HashiCorp's switch from the Mozilla Public License to the Business Source License affects Chainguard Images users. Paying customers receive six additional months of security patches for MPL-licensed HashiCorp tools, while free users retain access to the final MPL-based versions and may receive BUSL-based images through other distribution options. ### Source excerpt Chainguard's proactive approach to HashiCorp license changes: Secure image solution for hassle-free adaptation. ## Supabase Vault is now in Beta DevFeed: [Supabase Vault is now in Beta]() Original publisher: [Read original article]() Author: Michel Pelletier Published: 2022-12-16T07:00:00Z Content type: article Language: en Sources: [Supabase Blog]() Topics: [Encryption](), [Supabase](), [Databases](), [SQL](), [Replication]() Tags: [api-keys](), [backups](), [database](), [encryption](), [postgres](), [replication](), [secrets](), [sql](), [ui](), [vault]() ### AI overview Supabase Vault is a beta Postgres extension and UI for securely storing encrypted secrets and encrypting data in a database. It supports secret management, encryption keys, backups and replication that preserve encryption, SQL access through a Postgres view, and Transparent Column Encryption for protecting data from logs and backups. ### Source excerpt A Postgres extension to store encrypted secrets and encrypt data. ## Supabase Launch Week releases: Vault, Auth UI, Dashboard permissions, JSON Schema validation, and pg\_graphql updates DevFeed: [Supabase Launch Week releases: Vault, Auth UI, Dashboard permissions, JSON Schema validation, and pg\_graphql updates]() Original publisher: [Read original article]() Author: Paul Copplestone Published: 2022-08-19T07:00:00Z Content type: release Language: en Sources: [Supabase Blog]() Topics: [Supabase](), [Database](), [JSON Schema](), [Authorization](), [Encryption](), [GraphQL](), [React](), [ui](), [Rust]() Tags: [database](), [encryption](), [graphql](), [json-schema](), [new-feature](), [permissions](), [react](), [release](), [rust](), [ui](), [vault]() ### AI overview Supabase announces several Launch Week updates: Vault, a Postgres extension for managing secrets and encryption; a separately installable and customizable Auth UI package with initial React support; granular Dashboard permissions with Owner, Administrator, and Developer roles; JSON Schema validation through a new Postgres extension; and pg_graphql v0.4.0 with additional type support, filtering, larger-schema introspection, and bug fixes. ### Source excerpt Let's be honest, it's never just one more thing. ## Passwordless Remote Access to Windows Servers and Desktops DevFeed: [Passwordless Remote Access to Windows Servers and Desktops]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2021-12-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [remote access](), [Windows](), [Authentication](), [Security](), [Protocol (disambiguation)](), [browser]() Tags: [authentication](), [browser](), [rdp](), [remote-access](), [security](), [vault](), [windows]() ### AI overview This article explains how Teleport provides passwordless remote access to Windows servers and desktops through an in-browser desktop client, certificate-based authentication, SSO, and RBAC. It also introduces how Windows Remote Desktop Protocol works and discusses the security and operational drawbacks of password-based access. ### Source excerpt Learn how Teleport implements an in-browser desktop client and certificate-based authentication that allows passwordless access to Windows Servers and Desktops. ## Apache Airflow 1.10.12 DevFeed: [Apache Airflow 1.10.12]() Original publisher: [Read original article]() Author: Apache Airflow Published: 2020-08-25T00:00:00Z Content type: release Language: en Sources: [Apache Airflow Blog]() Topics: [airflow](), [sensitive data](), [Amazon S3](), [HashiCorp Vault](), [Kubernetes]() Tags: [airflow](), [apache](), [apache-airflow](), [bug-fixes](), [changelog](), [class](), [improvements](), [kubernetes](), [new-features](), [pypi](), [release](), [s3](), [secrets](), [sensitive-data](), [upgrade](), [vault]() ### AI overview Apache Airflow 1.10.12 is a release containing 113 commits since 1.10.11, including new features, improvements, bug fixes, and documentation changes. It adds custom XCom classes, secret-backed configuration for sensitive values, and AirflowClusterPolicyViolation support in local settings. The article recommends upgrading directly to 1.10.12 because Airflow 1.10.11 introduced breaking changes related to KubernetesExecutor and KubernetesPodOperator. ### Source excerpt Airflow 1.10.12 contains 113 commits since 1.10.11 and includes 5 new features, 23 improvements, 23 bug fixes, and several doc changes. Details: PyPI: https://pypi.org/project/apache-airflow/1.10.12/ Docs: https://airflow.apache.org/docs/1.10.12/ Changelog: http://airflow.apache.org/docs/1.10.12/changelog.html Airflow 1.10.11 has breaking changes with respect to KubernetesExecutor & KubernetesPodOperator so I recommend users to directly upgrade to Airflow 1.10.12 instead. Some of the noteworthy new features (user-facing) are: Allow defining custom XCom class Get Airflow configs with sensitive data from Secret Backends Add AirflowClusterPolicyViolation support to Airflow local settings Allow defining Custom XCom class Until Airflow 1.10.11, the XCom data was only stored in Airflow Metadatabase. From Airflow 1.10.12, users would be able to define custom XCom classes. This will allow users to transfer larger data between tasks. An example here would be to store XCom in S3 or GCS Bucket if the size of data that needs to be stored is larger than XCom.MAX_XCOM_SIZE (48 KB). PR: https://github.com/apache/airflow/pull/8560 Get Airflow configs with sensitive data from Secret Backends Users would be able to get the following Airflow configs from Secrets Backend like Hashicorp Vault: sql_alchemy_conn in [core] section fernet_key in [core] section broker_url in [celery] section flower_basic_auth in [celery] section result_backend in [celery] section password in [atlas] section smtp_password in [smtp] section bind_password in [ldap] section git_password in [kubernetes] section Further improving Airflow's Secret Management story, from Airflow 1.10.12, users don't need to hardcode the sensitive config value in airflow.cfg nor then need to use an Environment variable to set this config. For example, the metadata database connection string can either be set in airflow.cfg like this: [core] sql_alchemy_conn_secret = sql_alchemy_conn This will retrieve config option from the set Secre ## Simplifying Secrets for Go DevFeed: [Simplifying Secrets for Go]() Original publisher: [Read original article]() Author: André Eriksson Published: 2020-03-05T00:00:00Z Content type: article Language: en Sources: [Encore Updates]() Topics: [Go Language](), [API keys](), [Software Engineering]() Tags: [api-keys](), [go](), [secrets](), [software-engineering](), [vault]() ### AI overview The article explains how Encore aims to simplify secret management for Go applications. It describes declaring secrets in source code as variables, setting their values from the command line, storing them securely in Vault, and providing them to applications at startup. ### Source excerpt Learn how Encore makes writing secure code much simpler than before. Never feel tempted to commit secret keys to source code again. ## What's Coming To Keycloak DevFeed: [What's Coming To Keycloak]() Original publisher: [Read original article]() Author: Stian Thorgersen Published: 2019-09-03T00:00:00Z Content type: opinion Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [account](), [React](), [WebAuthn](), [Kubernetes](), [Operator Lifecycle Manager](), [API](), [Encryption](), [LDAP](), [health checks](), [Testing]() Tags: [account](), [api](), [authentication](), [automated](), [console](), [encryption](), [health-checks](), [idm](), [kerberos](), [keycloak](), [kubernetes](), [kubernetes-secrets](), [ldap](), [openid-connect](), [operator](), [password](), [rest-api](), [saml](), [software](), [sso](), [usability](), [user-experience](), [vault]() ### AI overview Keycloak's 2019 roadmap outlines planned work on a new React-based account console, WebAuthn authentication, a Kubernetes operator, external vault integration, user profiles, metrics and health checks, and improved automated testing and builds. ### Source excerpt New Account Console and Account REST API The current account console is getting dated. It is also having issues around usability and being hard to extend. For this reason we had the UXD team at Red Hat develop wireframes for a new account console. The new console is being implemented with React.js providing a better user experience as well as making it easier to extend and customise. JIRA - Account Console JIRA - Account REST API WebAuthn We are working towards adding WebAuthn support both for two factor authentication and passwordless experience. This task is not as simple as adding an authenticator for WebAuth, but will also require work on improving authentication flows and the account console. Design proposal - Authentication flow improvements Design proposal - WebAuthn Authenticator Design proposal - WebAuthn Two factor JIRA - Two factor JIRA - Passwordless Operator Operators are becoming an important way to manage software running on Kubernetes and we are working on an operator for Keycloak. The aim is to have an operator published on OperatorHub.io soon which provides basic install and seamless upgrade capabilities. This will be based on the awesome work done by the Red Hat Integreatly team. JIRA Integreatly Keycloak Operator Vault At the moment to keep credentials such as LDAP bind credentials more secure it is required to encrypt the whole database. This can be complex and can also have a performance overhead. We are working towards enabling loading credentials, such as LDAP bind credential and SMTP password, from an external vault. We're providing a built-in integration with Kubernetes secrets as well as an SPI allowing integrating with any vault provider. In the future we will also provide the option to encrypt other more dynamic credentials at rest in the database. JIRA - Vault JIRA - Encryption at rest User Profile Currently there's no single place to define user profiles for a realm. To resolve this we are planning to introduce the Profile SPI, which w