Credential Vault & Secrets Management
Relevant source files
The following files were used as context for generating this wiki page:
Overview
The Credential Vault is a secure storage system designed for network engineering teams to manage access keys, passwords, and SNMP communities without exposing them in plain text. It acts as a digital safe for the platform, ensuring that sensitive information used to talk to routers, switches, and DDI systems is encrypted and protected from unauthorized access.
The platform supports a wide range of vendors including Cisco (IOS, NX-OS), Juniper, Arista, Palo Alto, Fortinet, F5, and DDI providers like Infoblox and BlueCat. To maintain security, the platform follows a "local-first" and "self-hosted" philosophy where every change requires human approval and all AI decisions are audited.
Sources: CLAUDE.md:1-25, README.md:1-15
Architecture
The platform consists of seven core components that work together to manage the network. Each component has a specific role, similar to different teams in a Network Operations Center (NOC).
Platform Components
- Frontend: The operations console where you chat with the AI, view the topology map, and approve changes.
- API: The central communication hub that handles user requests and enforces security rules.
- Worker: The background engine that runs discovery jobs, takes config backups, and captures packets without blocking your session.
- Postgres: The system of record (database) that stores the platform's inventory and encrypted credentials.
- Neo4j: A living topology map that tracks how every device, interface, and subnet connects to everything else.
- Redis: A message broker and cache that passes instructions to the workers.
- Ollama: The optional local engine that provides AI reasoning without sending data to the cloud.
Sources: README.md:19-27, deploy/kubernetes/netops/values.yaml:130-180
Vendor Plugin System
The platform uses a standardized connector for each vendor. No matter whether you are talking to a Cisco router or a BlueCat Address Manager, the platform normalizes the output into a consistent format before doing anything with it. This allows the AI to understand your network regardless of the specific hardware brands you use.
Sources: README.md:28-35, CLAUDE.md:40-50
Deployment Options
- Docker Compose: A single-server option designed for labs or small teams. It allows you to bring up the full platform on one machine quickly.
- Kubernetes/Helm: The production-grade option for multi-node, highly available environments. It includes hardening by default, such as TLS encryption for all traffic and specific security policies to isolate untrusted tasks.
Sources: README.md:38-45, deploy/kubernetes/netops/README.md:1-40
Secrets Management Implementation
The platform uses "Envelope Encryption" to secure device credentials. This is like putting a key inside a locked box, where only a master key can open the box to get the actual key you need.
Key Management System (KMS)
The platform integrates with external Key Management Systems like AWS KMS, Azure Key Vault, or HashiCorp Vault. The pod (container) receives a reference to a master key but never the master key itself. This ensures that even if a database is stolen, the credentials cannot be decrypted without access to the secure KMS.
Sources: deploy/kubernetes/netops/values.yaml:90-120, backend/app/core/crypto.py:5-20
Encryption Process
When a credential is saved, the platform generates a unique Data Encryption Key (DEK). The DEK is used to encrypt the credential, and then the DEK itself is encrypted using the Master Key from the KMS.
Visual representation of how a password is transformed into encrypted data before being stored.
Sources: backend/app/core/crypto.py:25-50, backend/app/services/credentials/service.py:10-30
Change Approval Workflow
Every change requested by the AI or a user follows a strict lifecycle to prevent accidental outages.
- Draft: The AI specialist (like the DDI Agent) creates a proposed change.
- Pending Approval: The change appears in the frontend for a human engineer to review.
- Approved: A second human engineer authorizes the execution.
- Executing: The Automation Agent takes a pre-change config backup and applies the command.
- Completed/Rolled Back: The system verifies the change. If it fails, it uses the backup to roll back to the previous state.
The lifecycle of a network change from request to final verification.
Sources: README.md:10-18, backend/app/agents/ddi/agent.py:10-25, backend/app/agents/security/agent.py:10-25
Topology Data Model
The platform builds a comprehensive map of the infrastructure. This map is stored in Neo4j and tracks relationships rather than just a list of devices.
| Entity | Description | Relationships |
|---|---|---|
| Device | A router, switch, or firewall | Connects to Interfaces, belongs to a Site |
| Interface | A physical or logical port | Connected to other Interfaces, belongs to a Subnet |
| Subnet | An IP network range | Contains IP Addresses, linked to VLANs |
| VLAN | A layer 2 broadcast domain | Assigned to Interfaces |
| DNS Zone | A naming boundary (e.g., example.com) | Contains DNS Records |
| Application | A service like a web app | Depends on specific Subnets and DNS Records |
Sources: CLAUDE.md:80-90, backend/app/agents/documentation/agent.py:1-20
How the platform visualizes the connection between hardware, logical addressing, and services.
Sources: CLAUDE.md:85-95, backend/app/agents/documentation/agent.py:25-40
Credential Rotation
To keep the network secure, the platform supports scheduled credential rotation. This process generates new secrets and updates the stored records.
- Confirm-then-Swap: The system stages a new secret and verifies it against the device before making it the active credential.
- Fail-Closed: If a new secret cannot be verified, the old one remains active so you never lose access to your hardware.
- Alerting: If rotation fails repeatedly, the system alerts the NOC via structured logs.
Sources: backend/app/services/credentials/rotation.py:5-40, deploy/kubernetes/netops/values.yaml:350-380
Conclusion
The Credential Vault & Secrets Management system provides the security foundation for the AI Network Operations Platform. By using industry-standard encryption, KMS integration, and a human-in-the-loop approval process, it allows network teams to leverage AI automation while maintaining strict control over their most sensitive access credentials.