Highly available and reliable secret distribution infrastructure

1. A key master service (KMS) system configured to service requests initiated by a plurality of key master clients in a secret distribution infrastructure, the KMS system comprising:

one or more non-transitory computer readable storage media; and

program instructions, stored on the one or more computer readable storage media, to facilitate maintaining hydration of the KMS system, wherein the program instructions, when executed by one or more processing systems, direct the one or more processing systems to:

in response to a metadata polling trigger,

send a request for metadata updates to a metadata storage service;

process a response to the request for metadata updates to identify secret information that is out-of-date

due to a hydration event comprising one or more of an instantiation and a restart of the KMS system;

responsive to the hydration event, determine an availability of a second KMS

system in the secret distribution infrastructure;

determine a secret information source from which to obtain the updated secret information to hydrate the KMS system based on the availability of the second KMS system,

obtain the updated secret information from the determined secret information source; and

hydrate the KMS system with the updated secret information.

2. The KMS system of claim 1 , wherein the updated secret information is obtained from the second KMS system when the second KMS system is available in the secret distribution infrastructure and the updated secret information is obtained from a key vault and the metadata storage service when the second KMS system is not available in the secret distribution infrastructure.

3. The KMS system of claim 2 , wherein to determine the availability of the second KMS system, the program instructions when executed by the one or more processing systems, further direct the one or more processing systems to:

identify one or more local KMS systems within a same deployment as the KMS system; and

determine if at least one of the one or more local KMS systems is available to act as the second KMS system.

4. The KMS system of claim 3 , wherein the program instructions, when executed by the one or more processing systems, further direct the one or more processing systems to:

responsive to determining that the one or more local KMS systems are unavailable to act as the second KMS system, identify one or more remote KMS systems within different deployments than the KMS system; and

determine if at least one of the one or more remote KMS systems is available to act as the second KMS system.

5. The KMS system of claim 1 , wherein the program instructions, when executed by the one or more processing systems, further direct the one or more processing systems to:

when a response to the request for metadata updates is not received from the metadata storage service:

identify one or more local KMS systems within a same deployment as the KMS system;

request metadata from the one or more local KMS systems;

based on the metadata, determine that the secret information is out-of-date; and

attempt to hydrate the KMS system with updated secret information obtained from the one or more local KMS systems.

6. The KMS system of claim 5 , wherein the program instructions, when executed by the one or more processing systems, further direct the one or more processing systems to:

responsive to determining that the KMS system is unable to hydrate with updated secret information obtained from at least one of the one or more local KMS systems,

identify one or more remote KMS systems within different deployments than the KMS system;

request metadata from the one or more remote KMS systems;

based on the metadata, determine that the secret information is out-of-date; and

attempt to hydrate the KMS system with the updated secret information obtained from the one or more remote KMS systems.

7. The KMS system of claim 1 , wherein the secret information comprises one or more of certificates, passwords, keys, logins, and domain accounts.

8. The KMS system of claim 1 , wherein the key master clients are configured to provide end-user systems with access to external services.

9. A method of hydrating a key master service (KMS) system in a secret distribution infrastructure, the method comprising:

in response to detecting a metadata polling trigger, sending a request for metadata updates;

processing a response to the request for metadata updates to identify secret information that is out-of-date

due to a hydration event comprising one or more of an instantiation and a restart of the KMS system;

responsive to the hydration event, determining an availability of a second KMS system in the secret distribution infrastructure;

determining a secret information source from which to obtain updated secret information to hydrate the KMS system based on the availability of the second KMS system;

obtaining the updated secret information from the determined secret information source; and

hydrating the KMS system with the obtained updated secret information.

10. The method of claim 9 , wherein the updated secret information is obtained from the second KMS system when the second KMS system is available in the secret distribution infrastructure and the updated secret information is obtained from a key vault and a metadata storage service when the second KMS system is not available in the secret distribution infrastructure.

11. The method of claim 10 , wherein determining the availability of the second KMS system comprises:

identifying one or more local KMS systems within a same deployment as the KMS system; and

determining if at least one of the one or more local KMS systems is available to act as the second KMS system.

12. The method of claim 11 , further comprising:

responsive to determining that the one or more local KMS systems are unavailable to act as the second KMS system, identifying one or more remote KMS systems within different deployments than the KMS system; and

determining if at least one of the one or more remote KMS systems is available to act as the second KMS system.

13. The method of claim 9 , further comprising:

when a response to the request for metadata updates is not received from a metadata storage service:

identifying local KMS systems within a same deployment as the KMS system;

requesting metadata from the local KMS systems; and

when the secret information is out-of-date, attempting to hydrate the KMS system with the updated secret information obtained from one or more of the local KMS systems.

14. The method of claim 13 , further comprising:

responsive to determining that the KMS system was unable to hydrate with the updated secret information obtained from the one or more of the local KMS systems:

identifying remote KMS systems within a different deployment than the KMS system;

requesting metadata from the remote KMS systems; and

when the secret information is out-of-date, attempting to hydrate the KMS system with the updated secret information obtained from the one or more of the remote KMS systems.

15. The method of claim 9 , wherein the secret information comprises one or more of certificates, passwords, keys, logins, and domain accounts.

16. A secret distribution infrastructure comprising:

multiple key vaults that redundantly store secret information associated with an external service;

a metadata storage service that stores metadata associated with secret information; and

multiple key master deployments each including a plurality of KMS systems that service requests from a plurality of key master clients, wherein at least one KMS system of the plurality of KMS systems is configured to:

detect a metadata polling trigger;

in response to the metadata polling trigger, generate a request for metadata updates;

send the request for metadata updates to the metadata storage service; and

when a response to the request for metadata updates is received from the metadata storage service:

process the response to the request for metadata updates to identify secret information that is out-of-date; and

hydrate the at least one KMS system with updated secret information obtained from a key vault;

wherein the at least one KMS system is further configured to:

when a response to the request for metadata updates is not received from the metadata storage service:

identify one or more local KMS systems within a same deployment as the at least one KMS system; and

attempt to hydrate the at least one KMS system with the updated secret information obtained from the one or more local KMS systems.

17. The secret distribution infrastructure of claim 16 , wherein to attempt to hydrate the at least one KMS system with the updated secret information obtained from the one or more KMS systems, the at least one KMS system is further configured to:

responsive to detecting an inability to hydrate with the updated secret information obtained from the one or more local KMS systems:

identify one or more remote KMS systems within different deployments than the at least one KMS system; and

attempt to hydrate with the updated secret information obtained from the one or more remote KMS systems.